Every vendor named. Every commitment in writing.

A customer asks where the details they typed into your chatbot end up. Or it's your insurer. Or a larger company you want to work with sends you a four-page security questionnaire.

Under Quebec's Law 25, your business is the one that has to answer, even when a vendor like us runs the tool (ss. 3.1 and 18.3). This page gives you the answers.

Our role

When we set up a chatbot, a text-back after a missed call, review requests or appointment reminders, your customers' information stays yours. We handle it on your behalf, only to run the service you hired us for.

The law lets you hand your customers' information to a vendor without asking each customer for consent, on two conditions: the mandate is given in writing, and it spells out the protection measures (s. 18.3). That's the agreement described below.

Where the data goes

So part of the data is processed in the United States, and we'd rather tell you here than have you find it in a contract. Before personal information leaves Quebec, the law requires a privacy impact assessment (s. 17). We did ours. We also give you what you need to do yours: the vendor list, what each one receives and the protections in their contracts.

How it's protected

• Data travels encrypted (TLS 1.2 or newer) between your customers, your site and our vendors.
• The disk that holds the client portal is encrypted.
• Portal passwords are stored only in a form that can't be reversed. Invitation links work once and expire after 7 days, and sign-in attempts are limited.
• The chat logs we keep to improve the assistant replace email addresses and phone numbers with a placeholder.
• We keep only what the service needs, and we delete on a schedule published in our privacy policy. For example, an inquiry that didn't become a contract is deleted 24 months after the last contact.
• Most of our vendors are audited every year by independent firms. The list below says which ones, and the link to their proof is in our detailed list.

What we sign with you

Before we handle your customers' information, we sign a data processing agreement with you. It covers what section 18.3 of Law 25 requires from a vendor:

• we use the information only for the agreed service;
• the protection measures are written into the agreement;
• we notify your person in charge without delay of any incident or attempt;
• you can verify what we do;
• when the contract ends, we delete the data or hand it back, and confirm it in writing.

Ask for it before you sign anything with us.

If something goes wrong

We keep a register of confidentiality incidents, as the law requires (s. 3.8). If an incident touches your customers' information, we notify you without delay and contain it. Then we help you assess whether it presents a risk of serious injury.

If it does, the Commission d'accès à l'information and the people affected must be notified (s. 3.5). We prepare that notice with you.

What we don't have

Zasenami doesn't hold a SOC 2 report or an ISO 27001 certificate. Those audits are built for large companies' procurement teams. Several of our vendors have them; we don't. If your customer requires a SOC 2 report from every vendor, tell us on the first call. We'll tell you honestly whether we're the right fit.

The chatbot on zasenami.com currently runs on its AI provider's free tier. On that tier, the provider may use messages to improve its products, and human reviewers may read them. Don't type sensitive information into it.

The chatbots we install for clients use a paid API tier from an independently audited AI provider. On that tier, the provider processes messages on our behalf and doesn't use them to train its models.

Who else can reach the data

The law asks us to name the companies we entrust information to. Here they are.

Our full security questionnaire answers and the detailed list (audit proof and each vendor's agreement) are sent on request.