Security and compliance
Patient information stays in Canada.
End to end.
This page describes how Debrief handles patient-adjacent data: where it is stored, how it is protected, what gets scrubbed before storage, and who can access what. Written for institutional procurement, IT, and privacy officers.
Last updated: April 25, 2026.
Data residency
All storage and compute happens on Canadian infrastructure. The application, database, object storage, message queue, pipeline compute, transcription, language processing, and email delivery all run in Canadian regions under signed data processing agreements.
No data crosses the border.
Audio recordings, transcripts, structured assessment data, and the email that delivers notifications are all stored and processed exclusively on Canadian infrastructure.
Encryption
At rest
AES-256
All data at rest (database, object storage, message queue, and secret store) is encrypted with customer-managed keys, rotated annually.
In transit
TLS 1.2+
All data in transit uses TLS 1.2 or higher. HTTPS is forced at the load balancer and database connections require SSL.
Network isolation
The database sits in a private subnet with no public IP. It is only reachable from the application and pipeline worker. Object storage blocks all public access and is only readable through short-lived presigned URLs issued by the application after an authenticated, ownership-scoped check.
PHI handling
Audio recordings sometimes contain patient-identifying information even when the intent is to capture feedback about clinical skills. We treat this as expected, and the transcript is scrubbed before it is stored or displayed. The system covers all 18 HIPAA identifier categories plus Canadian-specific identifiers (SIN, provincial health card numbers, postal codes). Redactions are inline markers (for example, [REDACTED-NAME]) so auditors can see what was detected.
The resident reviews every output before it is exported or submitted. Resident review is the final gate.
Access control
Residents can only see their own sessions, recordings, and assessments. This is enforced at the application layer: every database query filters by the authenticated user, and API routes verify ownership before returning data or issuing presigned URLs. Program administrators see aggregate, de-identified metrics only.
Compliance posture
Debrief is designed with Canadian healthcare privacy requirements in mind. We are building toward alignment with:
PHIPA (Ontario) and provincial health-privacy equivalents
Governs how personal health information is collected, used, and disclosed in Ontario. British Columbia, Alberta, and Quebec have comparable frameworks (FIPPA/PIPA/HIA/Law 25).
PIPEDA (federal)
Federal private-sector privacy law applying to commercial activities across Canada.
Vulnerability disclosure
If you discover a security issue, please report it responsibly. We will respond within two business days.
security@debriefmd.ca