Shared SaaS
Multiple customer tenants would use shared infrastructure with mandatory logical isolation. Tenant-scoped access and data operations would be required throughout the application.
CANDEN.AI / TRUST
Trust & Compliance
Security and privacy principles guide how we plan future solutions, from access decisions to where customer data would be processed.
Security & Privacy by Design
Our intended approach combines least-privilege access, deny-by-default authorization and tenant isolation. Appropriate encryption in transit and at rest, auditability, data minimization, and defined retention and deletion practices would be requirements for each future solution.
Controls would need to be implemented, tested and operated throughout a solution’s lifecycle, with responsibilities and evidence defined for each engagement.
Hybrid Multi-Tenancy
We plan to assess two SaaS deployment models. Neither represents an available product today.
Dedicated Enterprise Silos
Customer-specific infrastructure and dedicated databases would separate customer environments, with no shared customer tables or schemas.
Global Data Residency
Our intended architecture would accommodate customer-specific residency requirements through appropriate regions and providers, including AWS, Azure and suitable sovereign hosting options.
Residency planning must cover storage, backups, processing, logging and other relevant data flows, including integrations and support access. Each proposed deployment would require a review of service availability, legal obligations and technical constraints.
We have not verified global residency support or deployed these future SaaS environments. Geographic commitments would be agreed only after solution-specific verification.
Compliance Alignment
Our architecture is being designed with security and privacy principles relevant to SOC 2, HIPAA, GDPR, MFIPPA, and PHIPA requirements. Specific controls, regulatory obligations, and deployment commitments are assessed for each solution and customer engagement.
- SOC 2: consider control ownership, evidence, auditability and ongoing operation before any assessment.
- HIPAA: assess applicability, safeguards and contractual obligations before any handling of protected health information.
- GDPR: assess lawful processing, data subject rights, minimization and international data transfers.
- MFIPPA and PHIPA: evaluate applicable Ontario public-sector privacy and health-information obligations for the customer and solution.
- FIPS 140-3: evaluate cryptographic module requirements and verify applicable module validation evidence for a proposed deployment. Standard encryption alone does not establish validation.
CANDEN.AI does not claim certification, attestation, a completed audit or full compliance with these frameworks. FIPS 140-3 validation has not been obtained. Architecture alone does not establish compliance; implemented controls, operating evidence and applicable assessments are required.
Start with your requirements