Security

In transit and at rest

The site and the API are served over HTTPS, and browsers are told to refuse anything else for two years (HSTS). A script runs on a page only if it carries a one-time code issued with that page; nothing else can run, and the site cannot be shown inside another site. Files are stored encrypted at rest on Cloudflare infrastructure (SOC 2 Type II, ISO 27001). Voice is handled by ElevenLabs (SOC 2 Type II) and texts by Twilio (SOC 2 Type II, ISO 27001). Certifications belong to those providers.

Checked from outside

These grades come from independent tools anyone can run. They are measured, not typed: each shows the day it was taken.

• Response headers: A+ — securityheaders.com, measured October 1, 2026.
• Browser protections: A+ (12 of 12 tests) — Mozilla Observatory, measured October 1, 2026.

Only what is needed

No card numbers, no SIN, no government ID at intake. If someone says one on a call it is not kept. Photos of papers are taken only with consent and can be deleted on request.

Kept only while the matter is open

Files are deleted when the matter closes, or sooner on request. Every access to a file by the office is logged.

Abuse and automation

Calls, texts and forms are rate-limited and screened for automated traffic. Repeated or automated contact is answered with a short notice and not kept.

Watched day and night

The phone line, the site, the text service and the email service are checked every five minutes, around the clock. A failure alerts the office.

Backups

The database is backed up every night, stored encrypted at rest and kept for 30 days. A full restore has been rehearsed.

Report a vulnerability

Email intake@remandly.ca. Machine-readable contact: /.well-known/security.txt. We read every report and do not pursue good-faith researchers.