All communications between your device and our servers are encrypted via TLS 1.2 or higher. Your data at rest is encrypted with AES-256.
Passwords are never stored in plain text — they are irreversibly hashed before being saved.
CarviQ is hosted on cloud infrastructure with SOC 2 Type II and ISO 27001 certifications. Our databases have automatic daily backups with 30-day retention.
Access to production environments is limited to authorized personnel and protected by multi-factor authentication (MFA).
CarviQ complies with Quebec’s Law 25 (Act to modernize legislative provisions as regards the protection of personal information) and PIPEDA (Personal Information Protection and Electronic Documents Act, Canada).
Your data is retained for as long as your account is active. Upon account deletion:
Document scans (stickers, invoices) are processed by our AI engine to extract relevant data. These images are used solely to generate suggestions and are not permanently retained after processing.
Important: data extracted by AI are suggestions — always validate the data before saving it to your history.
You have the right to:
To exercise these rights, write to us at [email protected].
If you discover a security flaw, contact us responsibly at [email protected]. We commit to responding within 72 business hours.
Questions about our privacy policy? Read our policy or write to us.