Data Sovereignty Commitment

The principles we work by

For First Nations clients, we work in a way aligned with the First Nations principles of OCAP® (Ownership, Control, Access and Possession). For Métis clients, we ask which principles you follow, such as OCAS (Ownership, Control, Access and Stewardship). For every client, your own laws, policies and protocols come first, and your terms replace ours where they differ.

There is no certification that makes a company "OCAP compliant", and we do not claim one. You are the judge of whether we meet these principles.

Our ten commitments

1. You own your data. Everything we touch or build from your data (reports, templates filled with your data, summaries, files) belongs to you.
2. We build in your account. Our work lives in your Microsoft or Google account, not in ours. Your administrators hold the master access, and we never hold the only key.
3. Your access is never gated by us. You can see, use and export your own data at any time, without asking us and without paying us.
4. Nothing is collected without a written list. Before we start, you approve exactly which information we will use, why, and for how long.
5. No AI training on your data. We do not train, fine-tune or improve any AI model with your data, and we do not allow our tools to do so where a setting controls it.
6. No secondary use. We never sell, share or reuse your data, and we never use your name, data or results in our marketing without your separate written consent.
7. Data location is disclosed in writing. We tell you, before work starts, where your data is stored and where any AI processing happens, including anything outside Canada. You decide.
8. People approve what matters. AI may draft. A named person in your organization approves invoices, reports, safety forms and anything about a person.
9. We leave nothing behind. When work ends, your staff run the system without us, our access is removed, and we sign an Exit and Deletion Certificate confirming we hold no copies.
10. You hear first if something goes wrong. If your information is exposed or lost while in our care, we tell you within 24 hours of finding out, and we follow the notification rules that apply.

What we cannot promise

Microsoft, Google, Amazon and Anthropic are U.S.-owned companies. Even when data is stored in Canada, U.S. legal orders to those providers are a residual risk that no Canadian contract can fully remove. We will tell you which tools carry this risk, help you choose settings that reduce it, and never describe Canadian storage as complete sovereignty.

How to hold us to this

Every engagement starts with a written Data Governance Agreement that turns these commitments into terms you can enforce. You can ask us for our current list of tools and data locations at any time.

OCAP® is a registered trademark of the First Nations Information Governance Centre (FNIGC). Reference to OCAP® does not imply endorsement by FNIGC. This commitment will be reviewed by our Indigenous affairs advisor by November 10, 2026.