Gestion de portes

Law 25 (An Act to modernize legislative provisions as regards the protection of personal information) came into force progressively in Québec from 2022 to 2023. It imposes new obligations on businesses regarding the protection of personal data.

Gestion de portes was designed from the outset with Law 25 compliance as a non-negotiable requirement — not as an afterthought checkbox.

Technical and organizational measures

Encryption of sensitive data

Tenant income is encrypted with AES-256 (pgcrypto) before being stored. Even in the event of database access, this data is unreadable.

Strict isolation between clients (RLS)

PostgreSQL Row Level Security ensures that one landlord can never access another's data, even in the event of a programming error.

Explicit consent

At sign-up, consent is explicitly requested (unchecked box). Consent dates and terms are recorded.

100% Québec-based hosting

All data is hosted on servers physically located in Beauharnois, Québec (OVH Canada). No data is transferred outside the province.

Right to erasure implemented

Complete deletion of a tenant file is available. Data is anonymized in logs and history.

Breach notification procedure

In the event of a confidentiality incident, we have a documented procedure to notify the CAI and affected individuals within the legal timeframes.

Your rights as a subscriber

As a landlord using Gestion de portes, you benefit from the following rights over your own data:

Access — export all your data from Settings → My account
Rectification — edit your information directly in the application
Deletion — close your account and your data is deleted within 30 days
Portability — export in JSON and CSV formats available

Your obligations as a landlord

By using Gestion de portes to manage your tenants' personal information, you act as the data controller within the meaning of Law 25. Gestion de portes acts as the processor.

In particular, you must:

Inform your tenants that their information is managed in a computer system
Obtain their consent before entering sensitive data (income)
Respond to their requests for access, rectification, or deletion

Privacy officer

In accordance with section 3.1 of Law 25, we have designated a privacy officer who can be reached at confidentialite@gestiondeportes.ca.

Data residency in Québec