Security and compliance
Trust is the product. Everything else is built on it.
Insurance runs on sensitive data and regulatory duty. EGEPilot was designed from day one for Canadian rules, not adapted to them afterwards.
The commitments
Canadian data residency
All client data, advisor data, and audit records are stored and processed in Canada. That includes AI processing: any inference over client data runs on Canadian infrastructure or under a contractually binding Canadian residency guarantee.
PIPEDA-aligned lifecycle
Consent recording, data export on request, staged and recoverable deletion, and legal-hold protection are built into the platform's data lifecycle, not bolted on.
Anonymous mode for AI
Client files can operate in anonymous mode: the AI works with the facts of the case while identity data is kept out of AI processing entirely.
Tiered data protection
Data is classified by sensitivity. Identity and health information is encrypted at rest with dedicated keys and never appears in logs, audit payloads, or AI prompts.
Provider verification
AI providers are individually verified against a live behavioral test suite before they can serve production traffic, and every model configuration change is recorded with who approved it and when.
Audit trail on everything
Every consequential action, from a client file update to an AI recommendation, writes an immutable audit event with actor, time, and context. Records exist because the system wrote them, not because someone remembered to.
Session and account security
- Multi-factor authentication on every account, no exceptions.
- Sessions are capped at 8 hours and expire after 30 minutes of inactivity. A meeting mode extends the idle window during live client meetings, explicitly and on the record.
- A maximum of two concurrent devices per advisor; a third login terminates the oldest session and notifies the advisor.
- Administrators can terminate an advisor's sessions instantly for compromise response.
Questions about a security review or your compliance requirements? Contact us.