MA Digitals Inc.
Legal

Security Policy

MA Digitals Solution Inc. Last Updated: October 16, 2026

1. Purpose and Scope

MA Digitals Solution Inc. ("Company", "we", "us", or "our") is committed to protecting the confidentiality, integrity, and availability of the information and systems entrusted to us. This Security Policy describes the safeguards we use to protect www.madigitals.ca (the "Website"), our internal systems, and the personal and business information of our clients and visitors in connection with our digital services (the "Services").

This Policy applies to our employees, contractors, and service providers who access our systems or data. It should be read together with our Privacy Policy, Cookie Policy, AI Usage Policy, and Terms and Conditions.

We design our security program to meet applicable legal requirements in Canada and the United States, including, where applicable:

  • Canada: the Personal Information Protection and Electronic Documents Act (PIPEDA), including its Safeguards principle and breach reporting rules; Quebec's Law 25; the Personal Information Protection Acts of Alberta and British Columbia; and Canada's Anti-Spam Legislation (CASL).
  • United States: Section 5 of the Federal Trade Commission Act (reasonable data security); state data security and breach notification laws in all 50 states; the California Consumer Privacy Act as amended by the CPRA (reasonable security and private right of action for certain breaches); the New York SHIELD Act; and other state security laws such as those in Massachusetts and Texas.

We also draw on recognized standards and frameworks such as the NIST Cybersecurity Framework, ISO/IEC 27001, and the CIS Critical Security Controls. Referring to these frameworks does not mean we hold a formal certification unless we say so.

3. Our Security Commitments

  • Risk-based approach: we apply safeguards proportionate to the sensitivity of the information and the risks involved.
  • Defense in depth: we use multiple layers of administrative, technical, and physical controls.
  • Least privilege: people receive only the access they need to do their jobs.
  • Continuous improvement: we review and update our controls regularly as threats and technology change.
  • Accountability: a designated security lead oversees this program.

4. Administrative Safeguards

  • Governance: we maintain a designated security and privacy lead responsible for this program, who can be reached at hello@madigitals.ca.
  • Policies and procedures: we maintain written internal procedures covering acceptable use, device security, password management, and data handling.
  • Personnel security: staff and contractors are bound by confidentiality obligations, receive security awareness training at onboarding and periodically, and lose access promptly when their role ends.
  • Risk assessments: we periodically assess risks to our systems and information and address material findings.
  • Vendor management: we review the security practices of service providers that handle our data, and we require appropriate contractual safeguards.

5. Technical Safeguards

5.1 Data protection

  • Encryption of data in transit using TLS (HTTPS) across the Website and our services.
  • Encryption of data at rest where supported by our hosting, storage, and device platforms.
  • Secure management of secrets, API keys, and credentials. Payment card data is handled by PCI DSS-compliant payment processors, and we do not store full card numbers.

5.2 Access control

  • Unique user accounts, strong password requirements, and a password manager for staff.
  • Multi-factor authentication (MFA) on email, cloud, hosting, code repositories, and administrative accounts.
  • Role-based access with periodic access reviews.

5.3 Network and application security

  • Firewalls, secure hosting configurations, and Web Application Firewall or DDoS protection where available.
  • Timely security patching and updates for operating systems, software, plugins, and dependencies.
  • Secure development practices, including code review, dependency checks, and testing for common vulnerabilities such as those in the OWASP Top 10.
  • Separation of development, testing, and production environments where practical.

5.4 Endpoint security

  • Company and contractor devices use up-to-date operating systems, endpoint protection, screen locks, and disk encryption.
  • Remote work follows secure connection practices, such as VPN or zero-trust access where appropriate.

5.5 Logging and monitoring

  • We log security-relevant events and monitor systems for suspicious activity and unauthorized access.
  • We retain security logs for a limited period appropriate to their purpose.

5.6 Backups and continuity

  • We perform regular backups of important systems and data, stored separately from production environments.
  • We maintain business continuity and recovery plans and test restoration periodically.

6. Physical Safeguards

Our offices, equipment, and any paper records are kept secure through locked premises, controlled access, and secure disposal. Our hosting and cloud providers maintain physical security of their data centers, including access controls and environmental protections.

7. Data Minimization, Retention, and Disposal

We collect only the information we need for stated purposes and keep it only as long as necessary for those purposes or as required by law, as described in our Privacy Policy. When information is no longer needed, we securely delete, destroy, or anonymize it using methods appropriate to its sensitivity.

8. Third-Party Services and Sub-Processors

We rely on third-party providers for hosting, analytics, email, payments, collaboration, and similar services. Before using a provider that handles personal or confidential information, we consider its security posture and use contracts that require appropriate safeguards and prompt notice of incidents. Data may be stored or processed in Canada, the United States, or other countries, as explained in our Privacy Policy. We are not responsible for the security of third-party websites that we link to.

9. Incident Response

We maintain an incident response process that includes:

  1. Detection and reporting: personnel must immediately report suspected incidents.
  2. Containment and investigation: we isolate affected systems, preserve evidence, and determine what happened and what information was involved.
  3. Remediation and recovery: we remove the threat, restore systems, and strengthen controls.
  4. Notification: we notify affected individuals, clients, regulators, and others as required by law.
  5. Review: we document the incident and update our practices.

10. Breach Notification

Canada. Under PIPEDA, if a breach of security safeguards creates a real risk of significant harm to an individual, we will report it to the Office of the Privacy Commissioner of Canada and notify affected individuals as soon as feasible, and we will keep a record of all breaches for at least 24 months. Where Quebec's Law 25 or provincial laws apply, we will also notify the relevant provincial regulator, such as the Commission d'accès à l'information du Québec or the Alberta Information and Privacy Commissioner.

United States. We will provide notice of a breach affecting personal information to affected residents, state attorneys general, and other authorities within the time and in the manner required by each applicable state law, and to credit reporting agencies where required.

Clients. Where we process client data as a service provider, we will notify the affected client without undue delay after confirming an incident that affects their data, so they can meet their own legal obligations. Notices will describe, to the extent known, what happened, the information involved, steps we are taking, and steps you can take to protect yourself.

11. Responsible Vulnerability Disclosure

We welcome reports from security researchers who find vulnerabilities in our Website or systems. If you discover one:

  • Email the details to hello@madigitals.ca with the subject line "Security Report", including steps to reproduce, affected URLs or systems, and your contact information.
  • Give us a reasonable period to investigate and fix the issue before any public disclosure.
  • Do not access, modify, or destroy data that is not yours, disrupt our services, use social engineering or physical attacks, or violate any law.

We will acknowledge good-faith reports promptly, keep you informed, and will not pursue legal action against researchers who follow this Policy. We do not currently offer a paid bug bounty program.

12. Your Role in Keeping Information Secure

Security is a shared responsibility. We ask you to:

  • Use strong, unique passwords and enable multi-factor authentication on any accounts we set up for you.
  • Keep your credentials, access links, and devices confidential and up to date.
  • Share information with us only through secure channels we approve, and avoid sending sensitive information such as passwords or payment details by ordinary email.
  • Tell us right away at hello@madigitals.ca if you suspect unauthorized access, a lost device, or a phishing attempt involving our name.
  • Be cautious of fake emails, calls, or messages. We will never ask for your password or full payment card details by email or phone.

13. Children

Our Website and Services are not directed to children under 13 (or the higher age set by applicable law), and we do not knowingly collect their personal information. If you believe a child has provided us with information, please contact us so we can remove it.

14. Limitations

No system is completely secure, and we cannot guarantee that information will never be accessed, lost, or disclosed without authorization. We commit to using reasonable and appropriate safeguards, but to the extent permitted by law, we are not liable for events beyond our reasonable control, as further described in our Terms and Conditions. Nothing in this Policy limits rights you have under applicable law that cannot be waived.

15. Changes to This Policy

We review this Policy at least annually and may update it to reflect changes in technology, threats, law, or our practices. The updated version will be posted on this page with a revised "Last Updated" date, and where required by law we will provide additional notice.

16. Contact Us

For security questions, to report a vulnerability or suspected incident, or to raise a concern about this Policy, please contact:

MA Digitals Solution Inc.
Email: hello@madigitals.ca 
Phone: +1 (437) 889 8973
Address: 15 Silas Hill Drive, North York, ON M2J 2X8
Website: www.madigitals.ca