Trust Centre – SturdyCloud IT Ltd.

Effective Date: April 2, 2026

Last Updated: July 6, 2026

Reviewed: Quarterly

Building Trust Through Secure, Responsible AI and Technology

At SturdyCloud IT Ltd., trust is at the core of everything we build.

We design and deliver AI, automation, cloud, and digital solutions with a focus on:

• Security
• Privacy
• Reliability
• Responsible AI use
• Accessibility
• Accountability
• Practical compliance

Our goal is to help businesses adopt technology confidently, with practical safeguards that reduce risk without adding unnecessary complexity.

This Trust Centre provides a general overview of our security, privacy, governance, responsible AI, accessibility, and compliance practices. It is for informational purposes only and does not amend or replace any written agreement. Where a client agreement, statement of work, procurement document, or other written contract includes stricter requirements, those requirements take precedence.

Our Approach to Trust

We take a practical, business-first approach to trust, security, and governance.

Our approach is based on a few core ideas:

• Apply real safeguards that support day-to-day operations
• Design systems with human oversight and accountability
• Use technology responsibly and transparently
• Adapt controls based on client needs, risk, and use case
• Continuously improve as systems, threats, and expectations evolve
• Build public demos and educational content without exposing real client data
• Treat accessibility, privacy, and compliance as development requirements, not afterthoughts

Security

We implement industry-aligned safeguards to protect systems, data, and client environments.

Key Security Practices

• Role-based and least-privilege access controls
• Secure authentication practices
• Encryption in transit
• Encryption at rest where applicable and supported
• Monitoring, logging, and alerting
• Secure cloud infrastructure and configuration practices
• Controlled integrations with third-party platforms
• Secrets management where applicable
• Separation of development, QA, UAT, staging, and production environments where practical
• No real client data in public demos or build-in-public content

Our practices align with SOC 2 readiness principles, with a focus on:

• Security
• Availability
• Confidentiality

We continue to strengthen our controls as part of our ongoing security and governance efforts.

Access Governance

Access to systems and data is limited to authorised personnel, contractors, and service providers who require access for legitimate business or service delivery purposes.

Our approach includes:

• least-privilege access wherever practical
• access granted based on role and responsibility
• removal or adjustment of access when no longer required
• logging and monitoring of relevant system activity
• administrative access controls for self-hosted tools, portals, document signing, scheduling, and automation systems

Incident Response

We maintain practical incident awareness and response practices to support timely handling of security, privacy, accessibility, AI, and service-related issues.

When appropriate, we aim to:

• assess and contain incidents promptly
• investigate the nature and scope of the issue
• mitigate impact and restore normal operations
• notify affected clients where required by law, contract, or circumstance
• apply lessons learned to improve future safeguards

Privacy

We respect and protect user and client data.

Our privacy practices are designed to align with applicable Canadian privacy obligations and support responsible handling of personal and business information.

Key Privacy Principles

• Collect only what is reasonably necessary
• Use information only for legitimate service and operational purposes
• Limit access to authorised parties
• Protect data using technical and organizational safeguards
• Provide transparency into how information is handled
• Support deletion, correction, access, and export requests where applicable
• Avoid use of client data for AI model training whenever possible

For more detail, clients and users should review our Privacy Policy.

CASL-Aware Communications

SturdyCloud uses electronic communications for inquiries, service delivery, updates, support, scheduling, marketing, and education.

Where CASL applies, our communication practices aim to support:

• appropriate consent or another lawful basis for commercial electronic messages
• clear sender identification
• contact information
• unsubscribe functionality where required
• prompt handling of opt-out requests
• separation between service/transactional messages and marketing communications where practical

Client-managed campaigns, automations, and AI-assisted outreach must be configured with compliant consent, suppression, and unsubscribe practices.

GDPR-Aware Data Handling

SturdyCloud is based in Ontario, Canada, but some websites, funnels, portals, or services may be accessed by individuals outside Canada.

Where GDPR or similar international privacy laws apply, we aim to support:

• transparent data handling
• documented processing purposes
• data minimisation
• appropriate retention
• data subject request handling where applicable
• appropriate vendor and transfer considerations
• client-specific data processing terms where required

Client-specific GDPR or international privacy requirements should be raised before implementation and documented in the applicable agreement.

AI Governance & Responsible Use

We design AI-enabled systems to be practical, transparent, and human-centred.

Core AI Commitments

• AI is used to support people, not replace accountable decision-making
• Material actions require human review and approval
• AI outputs should be reviewed before use
• AI systems are designed with safeguards, monitoring, and reasonable validation steps
• Higher-risk use cases are treated with greater caution
• AI-assisted outreach should be CASL-aware where applicable
• AI-enabled interfaces should consider WCAG 2.2 AA where applicable

We maintain a formal AI Usage & Data Governance Policy that outlines our principles for responsible AI system design, data handling, review processes, and output limitations.

AI Use Limitations

SturdyCloud does not use AI for fully automated:

• legal decisions
• financial or investment decisions
• employment or hiring decisions
• medical or health-related decisions
• other material decisions without human review

AI outputs may be useful for drafting, summarisation, recommendations, routing, customer support, scheduling, and operational support, but they are not a substitute for professional judgment or final human approval.

Data Handling & Residency

We prioritise secure and responsible data handling throughout the service lifecycle.

Our Approach

• Minimise data collection and retention where practical
• Process data only as needed to deliver services
• Support deletion or export requests where applicable, subject to legal and contractual requirements
• Avoid use of client data for AI model training whenever possible
• Prioritise Canadian data residency where feasible
• Notify Canadian clients when data residency in Canada is not possible for a given service or provider where appropriate
• Document client-specific requirements in written agreements

Where client-specific obligations apply, we can adapt handling practices through written agreements.

Third-Party Providers and Vendor Review

We rely on selected third-party providers to support infrastructure, communications, cloud services, scheduling, document signing, payments, and AI-enabled functionality.

These may include major cloud or technology platforms, software vendors, and specialised service providers.

Our Approach to Providers

• Evaluate providers based on security, privacy, reliability, and operational fit
• Limit shared data to what is reasonably necessary
• Consider provider data handling and training practices where relevant
• Favor providers and configurations that support stronger privacy and residency requirements where possible
• Apply client-specific restrictions where agreed
• Review whether provider limitations affect accessibility, privacy, CASL, GDPR-aware, or security requirements

Use of third-party services may also be subject to those providers' own terms, privacy practices, and service conditions.

Reliability, Backup & Continuity

We aim to design and operate systems in a way that supports stable service delivery and reasonable resilience.

Our approach may include:

• reliable hosting environments
• monitoring of key systems and integrations
• backup and recovery measures where appropriate to the service
• structured onboarding and implementation processes
• defined support expectations where included in client agreements
• practical incident response and escalation processes

Specific uptime commitments, service levels, backup scope, recovery targets, and support windows apply only where expressly included in a written agreement.

Accessibility — WCAG 2.2 AA Development Target

We are committed to inclusive and accessible digital experiences.

Where applicable, our websites, funnels, interfaces, portals, AI-enabled experiences, and client-facing digital tools should be designed with WCAG 2.2 AA as the development target.

We aim to support:

• clear and usable interfaces
• readable content structures
• keyboard navigation
• visible focus states
• adequate colour contrast
• accessible forms and error messages
• compatibility with assistive technologies where feasible
• captions, transcripts, or text alternatives for relevant media where practical
• ongoing accessibility improvements as systems evolve

If you encounter an accessibility barrier, please contact us.

Compliance & Governance

Our practices are informed by:

• Canadian privacy expectations
• CASL-aware electronic communication requirements
• GDPR-aware international data handling where applicable
• WCAG 2.2 AA accessibility expectations where applicable
• Industry-standard security and governance practices
• Client-specific compliance requirements where applicable
• Responsible AI and human oversight principles

We also recognise that different clients may require different control levels. For that reason, written agreements may impose stricter or more specific requirements than those summarised in this Trust Centre.

Transparency & Accountability

We believe trust is built through clarity, documentation, and continuous improvement.

Where appropriate, we maintain:

• system and access logs
• workflow and activity records
• prompt or configuration change tracking
• monitoring and review practices
• documented safeguards and service processes
• consent or communication preference records where applicable
• accessibility and development notes where applicable

We review this Trust Centre and related policies on a quarterly basis and update them as our services, controls, and obligations evolve.

Legal & Policy Documents

For more detailed information, please review our:

• Privacy Policy
• Terms of Service
• AI Usage & Data Governance Policy
• CASL, GDPR & WCAG Development Requirements

These documents work together to explain how we handle privacy, service terms, AI usage, accessibility, communications, and trust-related commitments.

Security, Privacy & Procurement Inquiries

If you have questions about our security, privacy, AI governance, accessibility practices, or client-specific requirements, please contact us.

We can respond to reasonable requests related to:

• policy clarification
• client-specific requirements
• procurement and trust review questions
• security and privacy discussions
• accessibility concerns
• CASL, GDPR-aware, and WCAG-related implementation expectations

Contact Information

SturdyCloud IT Ltd.

Email: contact@sturdyiq.ca

Website: https://sturdyiq.ca

Location: Ontario, Canada