Map information before choosing a hosting provider

A data map starts with purpose and access, then informs the technical decision.

ContractCanvas insights

Define each information flow

List engagement fields, attachments, account details, feedback and usage events separately. For each, record who supplies it, why it is needed, who can access it and when it should be deleted. A single label such as “customer data” hides materially different handling needs.

Ask provider questions

Identify processing locations, subcontractors, access controls, backup retention and deletion behaviour. Request the actual terms and technical evidence relevant to the proposed service. A provider’s security page does not prove that your application has configured its controls correctly.

Assign accountability

The OPC’s PIPEDA principles address accountability, identified purposes, limited collection, safeguards and access, among other duties. Determine the laws applicable to the actual organization and flows, including relevant provincial requirements. Appoint a responsible person and make the policy match the implemented system.

Keep the prototype boundary clear

ContractCanvas currently stores sample evaluation records locally. That is useful for workflow testing but does not establish a hosted privacy programme. The next build needs a documented data scope, provider arrangements and tested account separation before real customer information is introduced.

Sources checked

OPC fair information principles · checked 16 October 2026