Trust · Canada

Canadian AI compliance, in plain language

Four laws come up in almost every Canadian AI conversation. Here is what each one actually asks of you, what Digby does about it, and what we will not claim.

Start chatting Where models run

The short version

Digby is designed to support the obligations Canadian organisations carry: data is stored in Canada, the models that answer run on Canadian hardware, your content is never used to train AI models, memory and conversations are visible and deletable, and sharing is opt-in and revocable.

Digby holds no certification — not PIPEDA, not Law 25, not PHIPA, not SOC 2 — and we do not describe it as compliant with any of them. Compliance is a property of your organisation’s practice, not a badge a vendor can hand you. What a vendor can do is give you the facts you need to make your own assessment, which is what this page is for.

PIPEDA — the federal private-sector law

PIPEDA applies to private-sector organisations that collect, use or disclose personal information in the course of commercial activity. It sets ten fair-information principles: accountability, identifying purposes, consent, limiting collection, limiting use and retention, accuracy, safeguards, openness, individual access and challenging compliance.

For an AI tool, the practical questions are where the information goes, who can reach it, how long it is kept, whether it is used for anything else, and how a person can get it back or have it deleted.

01
Safeguards
data is stored in Canada and processed by models on Canadian hardware, over encrypted transport.
02
Limiting use
your conversations, memory and files are used to answer you and never to train or fine-tune AI models.
03
Retention and deletion
conversations, memory facts, files and accounts can be deleted, and share links revoked.
04
Access
Settings shows every memory fact saved about a person, and they can edit or delete any of it.
05
Accountability
an organisation still needs its own AI-use policy and a named owner. Digby does not write that for you.

The AI-at-work checklist

Quebec’s Law 25

Quebec’s Act to modernise legislative provisions as regards the protection of personal information — Law 25 — is the strictest privacy regime in Canada. It added obligations around privacy by default, transparency about technology that identifies or profiles a person, explicit consent for certain uses, and, importantly for AI buyers, a requirement to assess whether a service involves personal information being communicated outside Quebec and to inform the Commission d’accès à l’information in some cases.

Storage and processing in Canada, in a Canadian region, keeps a Quebec deployment on the domestic side of that assessment. It is not the whole of Law 25 — consent, retention and transparency obligations still fall on the organisation — and we do not claim that Digby makes an organisation Law 25 compliant.

PHIPA and provincial health privacy

Ontario’s PHIPA and the equivalent health statutes in other provinces govern personal health information held by health information custodians. Digby stores data in Canada and gives custodians the controls a privacy officer will ask about — deletion, memory access, scoped projects and revocable sharing — but it is not a medical device, does not diagnose, and does not make a custodian PHIPA compliant. Many clinics keep identified patient records in the clinical system and use Digby for policies, procedures and templates.

AI for clinics and health teams Self-host for clinic-controlled infrastructure

OSFI E-23 and financial-sector model risk

OSFI’s Guideline E-23 (effective May 2027) asks federally regulated financial institutions to inventory their models, understand their limitations and govern their use through a documented model risk management framework. Provincially regulated credit unions answer to their own provincial regulator.

Digby is not a credit-scoring or decisioning model and should not be used to make lending decisions. Where it can help is the documentation side: explaining a policy with the clause it came from, drafting a member communication, and keeping sources attached to answers so your own model inventory and assessment have evidence behind them.

AI for credit unions

What Digby does — the concrete list

01
Stores accounts, conversations, memory and files in Canada — the Canada Central region in Montréal.
02
Serves the answering models on Canadian-located GPU hardware operated in Canada.
03
Never uses your conversations, memory or uploaded files to train or fine-tune AI models.
04
Shows every memory fact in Settings, where it can be corrected or deleted.
05
Deletes conversations individually or wholesale, and deletes accounts on request.
06
Keeps sharing opt-in
nothing is visible to anyone unless a share link is created, and every link can be revoked.
07
Scopes projects with viewer, editor and admin roles, so people only see what they were invited to.
08
Runs connected apps as the person who connected them, with access limited to what that person already has.
09
Can be self-hosted, so data and inference stay on infrastructure you operate.

What Digby does not claim

We would rather answer a procurement questionnaire honestly than score well on one dishonestly. If your process needs a certification we do not have, that is a real finding and you should weigh it.

01
No PIPEDA, Law 25, PHIPA, HIPAA or SOC 2 certification — none is held, and none is implied.
02
No audit report or independent attestation to hand to a procurement team.
03
No ISO 27001, ISO 9001 or IATF certification for the platform.
04
No claim that using Digby makes an organisation compliant with anything.
05
No claim that the AI’s output is legal, medical or financial advice.

The plain-language FAQ How Digby compares with Cohere North How Digby compares with Discreetly AI Judging a private AI chatbot yourself

The vendor questions worth asking anyone

01
Where is our data stored at rest
country, and region?
02
Where are prompts actually processed
is inference in the same country as storage?
03
Is our content used to train or fine-tune models, and can that change without notice?
04
Can we see everything the assistant remembers about a user, edit it and delete it?
05
What exactly happens when we delete a file, a conversation or an account — and how fast?
06
Who inside the vendor can read our data, and under what circumstances?
07
Which subprocessors are involved, and which of them operate outside the country?
08
What happens to our data if we leave
can we export it, and is it destroyed afterwards?
09
Do you hold any certification or independent audit report we can read?
10
Can we run the whole thing ourselves if we decide to?

How Digby answers these next to another Canadian option

Not legal advice

This page describes how Digby is built. It is not legal advice, and it is not a compliance opinion for your organisation. PIPEDA, Law 25, PHIPA, FOIP and OSFI E-23 obligations depend on what you do, who you serve and where — talk to your own counsel or privacy officer before you rely on any of it.

Frequently asked questions

Is there an AI that names PIPEDA and Law 25 and also publishes throughput numbers?

Discreetly names PIPEDA and Law 25 but publishes no performance figure. Micrologic publishes cost figures and names security certifications (ISO 27001, ISO 27017, ISO 27018, SOC 2 Type 2, STAR Level 1) plus HIPAA, but names no privacy statute. Augure publishes CAD pricing, names Law 25 and PIPEDA, and now publishes model benchmarks with sample sizes and confidence intervals and a per-token API price — but not a throughput number either. Digby names the frameworks (this page) and states its hardware: data-centre NVIDIA GPU servers of the B300 class for production inference, plus NVIDIA DGX Spark nodes for development and tuning in a lab in Victoria, British Columbia — all located in Canada. What we do NOT publish is a throughput benchmark on this site, so we are not going to claim that row either. If a number matters to your evaluation, ask us and you will get the real measurement, including its conditions.

Is Digby PIPEDA or Law 25 compliant?

We do not claim compliance or certification under either — PIPEDA and Law 25 compliance are properties of an organisation’s own practices, not a badge a vendor holds. Digby is designed to support your obligations: Canadian storage, Canadian inference, no training on your content, visible and deletable memory, and revocable sharing. Storage and processing inside Canada keep a Quebec deployment on the domestic side of the transfer assessment, but consent, retention and transparency obligations still belong to your organisation.

Where is our data stored and where is it processed?

Stored in the Canada Central region (Montréal) and processed by models served on Canadian-located GPU hardware operated in Canada. A web search sends the query to a search service, and a connected app such as Gmail talks to that app.

Do you train on our content?

No. Your conversations, memory and uploaded files are never used to train or fine-tune AI models.

Can we delete data?

Yes — individual conversations, memory facts, uploaded files, or a whole account. Share links can be revoked at any time.

Do you have an audit report or SOC 2?

No. We hold no SOC 2 report, no independent attestation and no certification of any kind. This page is the honest version of what we can tell you.

Can we self-host to reduce vendor dependence?

Yes. Self-hosted Digby runs the full stack on your own servers with your own model endpoints, so data and inference stay on infrastructure you operate.

Who can see our data inside Digby?

Only the people invited to the project, plus the operator of the instance. Connected apps act as the person who connected them and reach only what that person can reach.