Security
People call this line on the worst night of their year. What they say is protected accordingly.
In transit and at rest
Every page and every call is served over HTTPS with HSTS. Files are stored encrypted at rest on Cloudflare infrastructure (SOC 2 Type II, ISO 27001). Voice is handled by ElevenLabs (SOC 2 Type II) and texts by Twilio (SOC 2 Type II, ISO 27001). Certifications belong to those providers.
Only what is needed
No card numbers, no SIN, no government ID at intake. If someone says one on a call it is not kept. Photos of papers are taken only with consent and can be deleted on request.
Kept only while the matter is open
Files are deleted when the matter closes, or sooner on request. Every access to a file by the office is logged.
Abuse and automation
Calls, texts and forms are rate-limited and screened for automated traffic. Repeated or automated contact is answered with a short notice and not kept.
Backups
Nightly encrypted backups, kept 30 days, with a tested restore procedure.
Report a vulnerability
Email security@remandly.ca (or ali@remandly.ca). Machine-readable contact: /.well-known/security.txt. We respond within two business days and do not pursue good-faith researchers.