Security and Privacy at Property Fox

Built in Canada. Designed for sensitive client information.

Property Fox helps Canadian mortgage professionals manage valuable and sensitive client information. Security and privacy are built into how the platform is designed, developed, and operated.

Our core production infrastructure and customer data are hosted in Canada. We handle personal information in accordance with applicable Canadian privacy laws and regulatory requirements.

Our security program is guided by the NIST Cybersecurity Framework and follows a risk-based, defence-in-depth approach.

Clear customer boundaries

Every Property Fox customer operates within a separate, tenant-scoped account.

These boundaries are enforced throughout the application and data architecture so that one customer’s information cannot be accessed from another customer’s account context.

Users, services, and workflows are given access only to the information required for the task they are performing. This principle of least privilege helps reduce unnecessary exposure and limits the impact of compromised credentials or software errors.

Authentication and access controls

Property Fox uses modern identity and access controls, including:
 

• multifactor authentication;

• Google and Microsoft sign-in;

• role-aware permissions;

• scoped access tokens;

• defined session lifetimes;

• secure account recovery; and

• session and access revocation.

Privileged access to our infrastructure and production systems is restricted and protected by mandatory multifactor authentication.

Encryption and Canadian infrastructure

Property Fox is hosted on Amazon Web Services using private production resources located in Canada.

Customer information is encrypted in transit and at rest across production databases, file storage, and backups.

Cloudflare provides an additional protective layer in front of the public-facing environment.

Production credentials and application secrets are securely stored in AWS Secrets Manager, with access restricted and auditable.

Controlled development and recovery

Our development, staging, and production environments are fully separated.

Production changes are documented, reviewed, tested, approved, and deployed through a controlled release process. Changes can also be rolled back when required.

Production databases and client information are backed up every 30 minutes. Backup access is isolated from normal application credentials, and backups are periodically tested to confirm that information can be restored.

Responsible data handling

Property Fox retains customer information only for as long as it is required to provide the service and meet applicable obligations.

Following account termination:
 

• active customer information is purged within 90 days; and

• the information ages out of backup systems within a further 60 days.

Production customer information is not copied into development or staging environments without the customer’s express permission.

Third-party service providers are carefully selected and given only the information and permissions required for their specific purpose.

A conservative approach to artificial intelligence

Property Fox takes a cautious approach to artificial intelligence.

Production client information is not currently sent to external AI model providers.

AI-assisted capabilities are designed to operate within the same customer, identity, and workflow boundaries as the rest of the platform. Authorization remains controlled by the application, not by an AI model.

AI does not act as a shared cross-customer memory system, and unrelated customers, borrowers, and files do not share context.

Logging, accountability, and incident response

Sensitive activity is logged to support operational accountability and security investigations.

Depending on the activity, Property Fox can record who performed an action, when it occurred, which customer account was active, and whether it was initiated by a user or by the system.

Property Fox also maintains an incident-response process covering identification, containment, investigation, recovery, customer communication, regulatory assessment, and corrective action.

Security is an ongoing responsibility

No single security control can eliminate every risk.

Property Fox uses multiple layers of protection, including tenant isolation, least-privilege access, encryption, private Canadian infrastructure, controlled production access, tested backups, logging, and conservative use of artificial intelligence.

Our objective is to reduce both the likelihood of a security incident and the potential impact if one occurs.

Questions about security or privacy?

Customers and prospective customers may contact Property Fox to discuss our approach to security, privacy, data handling, or access controls.

info@propertyfox.ai