Service · 03

Generative AI, without your data leaving Canada.

Generative AI deployment in a controlled environment: Canadian data residency, Loi 25-compliant logging, integrations with your existing systems. For organizations that cannot afford to have their data pass through OpenAI or Anthropic servers in clear.

Who it's for

Professional firms (lawyers, notaries, accountants, consultancies) handling confidential client information. Quebec public sector organizations subject to Loi 25. Financial services, insurance, healthcare. Any SMB that cannot answer « yes » to: « can you prove where your data goes when you use ChatGPT? ». If your teams already use public ChatGPT or Claude with client content pasted in, that's an immediate compliance risk.

What compliant means

Canadian data residency (AWS Bedrock ca-central-1 or Azure OpenAI Canada Central, no US transit). Isolated private VPC, no multi-tenant pooling. Logging respecting Loi 25 article 8 and following. SSO and role-based access control. At delivery, a compliance file usable directly by your privacy officer. Contractual commitment: no replication outside Canada, no US transit.

What we deliver

Feasibility audit

1-2 weeks. Evaluation of intended use cases, data sensitivity, regulatory constraints (Loi 25, PIPEDA for clients outside Quebec, sector-specific rules in health or finance). Recommendation Bedrock vs Azure, proposed architecture, schedule.

Infrastructure deployment

3-6 weeks. Private VPC provisioning, SSO integration (Microsoft Entra, Okta, Google Workspace), proxy with Loi 25-compliant logging (article 8 and following), retention policies. Load testing on estimated volume.

Custom integrations

Connection to your systems: SharePoint, Drive, CRM, internal documentation, business tools. Prompts and guardrails specific to your use cases. Acceptance testing with your teams.

Training, compliance file, handoff

Your teams trained on usage and limits. Compliance file (architecture, data flows, technical measures, processing register) delivered to your privacy officer. Continued operation under mandate or IT handoff.

What we don't do

We don't act as your data processor without a formal contractual framework signed beforehand.
We don't deliver legal opinions on your Loi 25 compliance: we deliver technically-compliant infrastructure and applications, your privacy officer and legal counsel remain the authorities.
We don't deploy without direct involvement from your privacy officer or equivalent.
We don't host your data ourselves: the cloud account stays in your name (Bedrock, Azure).
We don't offer multi-tenant SaaS.

Engagement format

Duration

Audit 1-2 weeks, deployment 3-6 weeks

Client involvement

Tight: privacy officer, IT team, legal counsel on client side

Cadence

Fixed-fee audit (deductible if you continue), fixed-fee deployment, cloud infrastructure billed directly by AWS or Azure (no markup)

Frequently asked questions

What if AWS or Azure changes their TOS?

The contractual residency commitment is between you and the cloud provider (AWS Canada `ca-central-1` or Azure Canada Central). If TOS change, the provider framework remains the reference. Our application doesn't reintroduce out-of-Canada transit by configuration.

What if we don't have a privacy officer?

Loi 25 requires a privacy officer above 50 employees. Smaller organizations can have the role assumed by an executive or external legal counsel. The compliance file is documented to be usable by any designated officer.

Who pays for cloud infrastructure?

You, directly to AWS or Microsoft, on your own cloud account. No markup on Triatlas's side. Our billing covers audit, initial deployment, and ongoing operation, not cloud consumption.

SLA coverage and ongoing operation?

Defined by mandate based on criticality (business hours or 24/7, response time targets, escalation). If you prefer to operate in-house after delivery, we document fully and train your IT team.

Ready to use generative AI in compliance?

Request a feasibility audit