The questions to ask a software vendor before handing over data

Six questions are enough to size up a software vendor before handing it personal information: where the data is physically hosted, which subprocessors touch it, what is sent to a language-model provider, how long each copy is kept, what triggers a breach notice, and what happens to the data when the contract ends. Québec's Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1), as amended by Law 25, frames every one of them. Section 18.3 provides that a business communicating personal information to a third party for the performance of a mandate or a contract for services must give that mandate in writing and set out in it the measures the third party is to take to protect the confidentiality of the information, to use it only in the performance of the mandate, and not to keep it once the mandate expires. The Commission d'accès à l'information publishes a summary of the changes. A vendor that cannot answer in writing leaves those requirements with nothing verifiable in them.

'Where is the data hosted?' calls for a city and a company name, not an adjective. An honest answer names the data-centre operator and the specific region where the application and its database are served, then separates primary hosting from backup copies, which routinely travel further than the production database. An evasive answer offers 'world-class secure infrastructure' or 'Canadian cloud' and names nobody. The gap matters because section 17 of the Act requires a privacy impact assessment before personal information is communicated outside Québec, and equally before a business entrusts a person or body outside Québec with the task of collecting, using, releasing or keeping such information on its behalf. The assessment covers the sensitivity of the information, the purpose of its use, the protection measures it would be given and the legal framework in force where it would be communicated, and the section then calls for a written agreement reflecting the findings of that assessment.

The subprocessor list tells you more than the privacy policy does. A business application involves several of them, in different roles: hosting, transactional email, file storage, application logging, payment gateway, backup service. Section 18.3 of the Act addresses the communication of personal information to a third party where it is necessary for the performance of a mandate or a contract of enterprise or for services, and in that case requires a written mandate setting out the protection measures. An honest answer arrives as a dated list with each vendor's role, legal name and country, plus a line on what each one actually sees. An evasive answer says 'all our partners are certified' — a certification tells you neither who they are nor which data passes through them.

The question that separates serious vendors is the language-model question, and it comes in three parts: which provider receives the text, what exactly is in what gets sent, and what happens when that provider is unavailable. The third part is the one that can undo the other two: automatic failover to a second provider is an ordinary resilience pattern, and nothing requires that second provider to fall under the same legal regime as the primary. OffrePro's own case, set out below, is a verifiable example in code. An honest answer names the primary provider, the fallback list in the order it is tried, and separates masked identifiers from the substance sent in the clear. The same reasoning applies to bringing generative AI into a Québec SMB.

'How long is the data kept?' is a plural question, because there is more than one copy. The document itself, the backups, the application logs, the AI audit trail and whatever the model provider retains all run on different clocks, set by different parties. Section 23 of the Act provides that personal information must be destroyed or anonymized once the purposes for which it was collected or used are achieved, subject to a retention period provided by law. An honest answer gives a number per category and names what it does not control: retention at a subprocessor is not retention at the vendor. 'Zero data retention' does not stand on its own: it is checked by asking which account it applies to, whether it is the default or a setting that was switched on, since when, and which provider document establishes it.

Breach handling has a precise legal regime, and it is a good test of a vendor's maturity. Section 3.5 of the Act requires a business with reason to believe an incident has occurred to take reasonable measures to reduce the risk of injury and, where the incident presents a risk of serious injury, to promptly notify the Commission d'accès à l'information and the persons concerned. Section 3.8 requires a register of confidentiality incidents, which the Regulation respecting confidentiality incidents requires be kept for at least five years. Section 90.12 caps the administrative monetary penalty at $50,000 for a natural person and, in all other cases, at $10,000,000 or, if greater, 2% of worldwide turnover for the preceding fiscal year. An honest answer gives a contractual notice deadline, a channel, and a named person.

'What happens to the data when the contract ends?' splits into two separate questions: what can be returned, and what gets destroyed. The portability right in section 27, in force since September 22, 2024, covers computerized personal information collected from the applicant (not created or inferred from information concerning them), communicated on request in a structured, commonly used technological format. It therefore covers neither an entire business file nor the documents the software produced. An honest answer distinguishes the export the product offers from the right the Act creates, states the format and the turnaround, and says plainly when no export function exists yet. An absence is useful information; ambiguity is not.

Run against OffrePro, this checklist produces uneven answers, and that is the point. The first question, hosting, is not settled in a source file: the location depends entirely on deployment configuration, and it is the privacy policy that states it, not the code. The model-provider registry holds nine entries: one entry for a self-hosted model whose address is set at deployment; Cohere, a Canadian company; Mistral, a French company; and six entries for American companies. A company's nationality says nothing about the region where a request is processed, and the code does not fix it. The default fallback chain is 'cerebras,groq,cohere', so a deployment configured on a Canadian provider can have a request picked up by an American company when the primary is unavailable.

OffrePro's remaining answers are of the same kind: verifiable, and incomplete. The identifiers held on client records (the contact person's name, the client organization's name, email addresses, phone numbers) are replaced with neutral tokens at a single outbound point, then restored locally on the way back. This pseudonymization targets identifiers, not substance: the description of the mandate, the services and the amounts submitted for drafting are transmitted as written, and a person's name typed freely into a context note, without matching a stored record, may not be masked. The word matters: the mapping is held in the application's memory for the duration of the call, which makes the operation reversible and rules out calling it anonymization.

The AI audit trail is pseudonymized at rest and purged after 90 days by default; the assistant's plans, by contrast, hold an unmasked plan and the user's raw message, purged on the same horizon. No non-retention flag is sent to the model provider: what it keeps on its side is governed by its own contract, not by this code. No bulk export of an account's data in a structured format exists today; proposals, invoices and letters are downloaded one at a time as PDFs. The application log filter covers context notes, email addresses and tokens, but not people's names, company names, phone numbers, or document subjects and titles. A vendor that answers this way is no more virtuous than another; it is merely checkable, which remains the only thing a buyer can assess before signing, including when the question is automating business documents without losing your voice. This article describes legislative provisions; it is not legal advice.