Privacy Policy

Effective October 21, 2026

1. Who we are

Proofwell ("we", "us") provides cyber insurance readiness assessments and a self-serve scanning portal for small businesses and their IT providers. We are based in Vancouver, British Columbia, Canada. We handle personal information in line with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and British Columbia's Personal Information Protection Act (PIPA).

Questions or requests about privacy go to our privacy contact at [email protected].

2. What we collect

When you contact us or book an assessment

Your name, email address, company name, and anything you choose to tell us in your message, such as your renewal date or how many staff you have.

When you sign in to the portal

When you sign in with Microsoft, we receive your name, work email address, and your organisation's Microsoft tenant ID. We use a session cookie to keep you signed in. We don't use advertising or tracking cookies.

When you connect Microsoft 365

A Global Administrator in your organisation approves read-only access for our scanner. The scanner then reads the security settings that cyber insurers ask about:

• Sign-in security settings: security defaults, Conditional Access policies, and whether legacy sign-in is blocked.
• For each user account: the user principal name (usually their email address), account type, whether the account is enabled, and which sign-in methods are registered (for example "Authenticator app" or "phone"). We read the type of method, not the phone number or any secrets.
• Which accounts hold administrator roles.
• Devices managed in Microsoft Intune: device name, operating system and version, whether the disk is encrypted, compliance status and last check-in time.
• Your email domains, and the public DNS records (SPF, DKIM and DMARC) for those domains.
• Your Microsoft Secure Score.

The scanner cannot read email content, files, OneDrive or SharePoint documents, Teams messages, calendars or contacts, and it cannot change any setting.

Evidence you provide

Answers you enter in the evidence form (for example your backup product, EDR coverage, training provider and incident response plan) and any files you upload, such as a coverage export or a plan document. Please don't upload documents containing passwords or more personal information than the question needs.

When you pay

Payments are processed by Stripe. We receive confirmation of the payment, the amount, your email address and billing name. We never see or store your full card number.

When an IT provider runs the scan for you

If your IT provider (MSP) uses Proofwell on your behalf, they may give us read-only access through an app registered in your tenant. We store that app's credentials encrypted and use them only to run the scans they request.

3. How we use it

• To run scans and produce your readiness report, draft questionnaire answers and evidence pack.
• To run your account: approving sign-ups, controlling access, and sending service emails such as "your access is approved".
• To process payments and keep business and tax records.
• To answer your questions and provide support.
• To keep the service secure, for example by detecting abuse and investigating errors.

We don't sell or rent personal information, don't use it for advertising, and don't use your tenant data to train AI models. We'll only send you marketing email if you ask to receive it, and you can opt out at any time.

4. Who we share it with

We share information only with the service providers that help us run Proofwell, and only what each one needs:

Some of these providers may process information outside Canada, including in the United States, where it may be accessible to authorities under local law. Each is bound by contract to protect it.

We share your report with your insurer, broker or anyone else only if you ask us to. You control where your report goes. We may also disclose information if the law requires it.

5. How long we keep it

• Reports and evidence packs: deleted automatically 180 days after each scan. A short record that the scan happened (date and score) is kept with your account.
• Your account and evidence answers: kept while you have an account, and deleted within 30 days after you ask us to close it.
• Payment and invoice records: kept for six years, as Canadian tax law requires.
• Security logs: kept for up to 12 months.
• Backups: encrypted backups roll over within 30 days, so deleted data leaves our backups within that time.

6. How we protect it

• All traffic is encrypted with HTTPS, and stored data is on encrypted disks.
• The scanner's access to your tenant is read-only and limited to the permissions listed on the consent screen.
• Client app secrets are encrypted at rest and never shown again after you enter them.
• Our admin console requires a password and a one-time code, and it locks out repeated failed sign-ins.
• Servers are patched automatically and are reachable only on the ports they need.

No system is perfectly secure. If a breach affecting your personal information creates a real risk of significant harm, we'll notify you and the Privacy Commissioner as the law requires.

7. Removing our access

You can stop the scanner reading your tenant at any time. Go to Microsoft Entra admin center > Enterprise applications, select Proofwell, and delete it, or remove the app your IT provider registered. You can also email us to close your account.

8. Your rights

You can ask to see the personal information we hold about you, correct it, or have it deleted. You can also withdraw your consent, although we may then be unable to provide the service. Email [email protected] and we'll respond within 30 days.

If you aren't satisfied with our response, you can contact the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner for British Columbia.

9. Changes

If we make an important change to this policy, we'll update the date at the top and tell active customers by email before it takes effect.