Security and privacy

The platform handles sensitive information: income, down payment, financial situation, real estate plans. It is built accordingly.

Hosting in Canada

Documents and the database are hosted on servers located in Canada. Some services (text messages, email delivery and part of the artificial intelligence processing) are performed outside Canada, under written agreements. Details are on the Hosting and providers page.

Encryption at rest and in transit

Data is encrypted when it is stored and when it travels over the network.

Minimal retention

Documents are not kept indefinitely at DeepFlow: they are automatically destroyed about 120 days after they are received, a period the broker can extend once, by 60 days. The information extracted from the documents is erased at the same time. A client record (name, contact details and loan terms, with no documents) remains in the broker’s workspace for renewal follow-up, until the broker or the person concerned asks for it to be deleted.

Segregated access

Each broker workspace is isolated: a broker never has access to another broker’s files. Files are delivered directly to the broker’s tools: their CRM, their mortgage software and their inbox.

Verified access

The client opens their upload space using a one-time code sent to their email address, then gives their consent before uploading anything. On the broker’s side, sign-in is protected by an anti-bot test and by two-factor authentication, which each user can turn on.

Audit log

Every important action is logged. The log never contains the content of documents; the information extracted from them is erased from it when the retention period ends.

No secondary use

Information is never sold, is not used for any advertising purpose and is not used to train any artificial intelligence model. This includes uploaded documents, form answers, qualification text exchanges and AI-generated scores. The providers that run the platform are contractually bound by the same rule.

An agreement with each broker

A written agreement on the protection of personal information, as provided for in section 18.3 of Law 25, is entered into with each broker; it sets out each party’s responsibilities.

DeepFlow’s role is to make it easy for the broker to meet their obligations under Law 25 and the AMF’s regulatory framework. The complete security documentation is available on request: deepflow_ai@outlook.com.