Security & Compliance
Protecting every candidate and every client, by design.
Background screening involves some of the most sensitive personal information there is. PeopleCheck is built on independently certified infrastructure, keeps your files in Canada, and follows Canadian privacy principles.
SOC 2 Type II
Application platform and cloud storage
ISO/IEC 27001
Information security management
ISO 27017 / 27018
Cloud security and personal data in the cloud
PCI DSS
Card payments processed by a Level 1 provider
PIPEDA
Canadian privacy principles
How we safeguard your data
Canadian data residency
Screening documents, IDs, consent forms and reports are stored in a private file store located in Canada, operated on Amazon Web Services infrastructure.
Encryption in transit
All traffic to peoplecheckcanada.ca is served over HTTPS/TLS, and a strict Content Security Policy limits which services the site may communicate with.
Encryption at rest
Files and database records are kept on infrastructure that encrypts stored data, with access restricted to authorized systems.
Private, time-limited file access
Documents are never public. Each download uses a short-lived secure link issued only after we confirm the person is allowed to see that specific check.
Role-based access
Purchasers, candidates, Checkers and Approvers each see only what their role permits. Access rules are enforced in the database itself, not just the screen.
Controlled accounts
There is no public sign-up. Accounts are created only through a paid purchase, an authorized invitation or by our Approvers.
Secure payments
Card details are entered directly with our payment processor and never touch or get stored on our servers.
Monitoring and response
We maintain an incident response plan, publish a security.txt contact, and run regular security scans of our code and dependencies.
Certified infrastructure partners
Our platform runs on providers that are independently audited against leading security standards.
Application platform (Lovable)
- SOC 2 Type II attested, with independent audit of security controls over an observation period.
- ISO/IEC 27001 certified information security management.
- GDPR-aligned data protection practices.
Cloud storage (Amazon Web Services, Canada region)
- SOC 1, SOC 2 and SOC 3 reports.
- ISO/IEC 27001, 27017 and 27018 certifications.
- PCI DSS Level 1 service provider; supports HIPAA and GDPR programs.
Privacy and consent
We collect only what each screening requires, obtain the candidate's informed consent before any check, and share results only with the organization that requested them. Individuals can request access to or correction of their information at any time. Read our Privacy Policy and Terms & Conditions.
Security questions or vendor due-diligence requests: info@peoplecheckcanada.ca