The short version
In a project, we work inside your systems: your Microsoft 365, your ERP, your files. That data stays with you. Some tools are hosted by Avenor, such as Avenor Email and the CRMs we run for clients: this page says exactly where their data lives. Nothing goes out unless a person has checked it: our tools prepare drafts, they do not send email.
Where the data lives
| What | Where | Details |
|---|---|---|
| Your email and calendars | Your Microsoft 365 (or Google) | Read where they are, with access limited to the mailboxes in scope. We do not make a full copy. |
| CRMs and tracking in tools hosted by Avenor | Cloudflare (D1 databases) | Cloudflare picks the server region. For this type of database, Cloudflare offers jurisdictions for the European Union, the United States and FedRAMP, but not for Canada. No jurisdiction is set on our databases today. |
| Files uploaded to a CRM | Cloudflare | Same host, access limited to members of the workspace. |
| Text sent to the AI model | Anthropic (United States), Claude models | By default, Anthropic does not use inputs and outputs from its commercial products to train its models (Anthropic policy dated August 18, 2026). |
| CRM backups | Avenor’s OneDrive storage (Microsoft) | One copy per week, outside Cloudflare. Restore tested on October 27, 2026. |
If your organization requires its data to stay in Canada, tell us before the quote: we then plan an installation in your own environment (section 6).
What we keep, and what we don’t
When a CRM is fed from email, it keeps only a short record: the date, the direction (received or sent), the client, the contact, the subject and a short preview. Not the body of the email, not the attachments.
Teams meeting transcripts are never kept: only the summary and the action items stay in the file. For another company’s calendar, we keep only busy times, never the title, location or attendees.
One client’s data is never used for another client. It is never sold or traded.
Who has access, and how it is protected
You sign in to our tools with your organization’s Microsoft account. Only people listed as members of your workspace have access.
The tokens that give access to your Microsoft 365 are encrypted at rest (AES-GCM, 256-bit). The encryption key is kept separately, never with the data. All traffic uses HTTPS.
A log records the actions taken by the tool: who created, changed or deleted which draft, and which attachment was saved. Avenor keeps administrator access for support, as set out in your written agreement.
Law 25 in a project
Avenor’s person in charge of the protection of personal information is Raphaël Dionne, founder, reachable at [email protected].
When a project processes personal information, or communicates it outside Quebec (Cloudflare and Anthropic are), we carry out the privacy impact assessment with you before going live. Your obligations are in the quote, not an add-on at the end of the project.
A confidentiality incident is recorded and reported to you without delay. If it presents a risk of serious injury, the people concerned and the Commission d’accès à l’information are notified. A request for access, correction or deletion is answered within thirty days. The rest of our policy is on the legal page.
Public sector and health care
For a public organization or a health care network, the tools can be installed in your own environment instead of Avenor’s. Your data then stays in your infrastructure, under your access rules and your logging. We assess this with you at the first meeting, before pricing the project.
What we don’t claim
Avenor does not hold a security certification in its own name. Cloudflare, Microsoft and Anthropic publish theirs. If your organization has a security questionnaire, we fill it in with these facts, and we tell you when an answer is “no”.
Questions before you start? See our services, take the free diagnostic or write to us.