Security and data residency.

Vakt is built for institutions whose data sovereignty, audit trail, and procurement diligence requirements are non-negotiable.

Your data stays in Canada.

All Vakt platform infrastructure runs in AWS Canada (Central) — ca-central-1, the AWS region located in Montreal. Customer environmental data, account data, configuration data, and operational telemetry are stored, processed, and analyzed entirely within Canadian jurisdiction.

Vakt does not replicate customer data to AWS regions outside of Canada. Vakt does not transit customer data through third-party services hosted outside of Canada in the operational flow.

This data residency commitment is foundational to how Vakt is built — not a configurable option that varies by customer.

Encrypted in transit and at rest.

—
In transit. All communication between sensors, sensor relays, the Vakt platform, customer dashboards, and the Vakt API uses TLS 1.2 or higher.
—
At rest. All customer data stored in DynamoDB, S3, and other AWS storage services is encrypted at rest using AWS-managed encryption.
—
API authentication. Per-organization API keys with role-based access control. Keys can be rotated and revoked without service interruption.

Built for Canadian privacy and procurement requirements.

—
PIPEDA. Vakt's data handling is designed around the Personal Information Protection and Electronic Documents Act, the federal Canadian privacy framework governing commercial data.
—
Quebec Law 25. Vakt's Canadian-only data residency and breach notification posture are aligned with the requirements of Quebec's modernized privacy legislation, applicable to any institution operating in Quebec.
—
Federal procurement. Vakt's Canadian data residency posture supports institutions subject to federal procurement requirements regarding cloud service data location.

Every reading. Every event. Indefinitely retained.

Vakt's architecture treats environmental data as evidentiary. Every reading from every sensor is captured at ingestion and retained indefinitely — not summarized, not down-sampled, not aggregated away.

Compliance evaluations, alert events, threshold changes, and configuration changes are logged with timestamps, attributing actor, and prior state. The audit trail supports the data integrity requirements of regulatory frameworks including 21 CFR Part 11 ALCOA+ principles for institutions whose compliance posture requires it.

On the certification roadmap.

Vakt is in the process of formalizing certifications appropriate for institutional procurement. Current status:

—
SOC 2 Type II. In progress. Target completion 2027.
—
PIPEDA alignment. Operational baseline.
—
Quebec Law 25 alignment. Operational baseline.
—
WCAG 2.1 AA accessibility. In progress for the customer dashboard.

For institutions with specific procurement diligence requirements, Vakt provides architecture documentation, data handling descriptions, and security posture documentation under NDA. Contact us to begin a procurement review.

Contact Procurement