Security & Compliance

Steller is built and operated by a Canadian company. Customer account data (user accounts, organization settings, authentication) is stored and processed on servers in Toronto, Canada. The permit data Steller analyzes is public municipal open data sourced from city open-data portals; it contains no personal information and is processed in a data warehouse. For BC municipalities operating under the Freedom of Information and Protection of Privacy Act (FOIPPA), the account data hosting location supports your s.69(5) Privacy Impact Assessment obligations. For current, contract-grade data-processing details, request our Data Processing Addendum at [email protected].

All data is encrypted in transit (TLS 1.3) and at rest (AES-256). Database backups are encrypted with the same standard.

Access requires authentication via JWT tokens (72-hour expiry). Passwords are hashed using bcrypt with SHA-256 pre-stretching. Login attempts are rate-limited and blocked after 10 failures in 10 minutes.

In the event of a data breach, affected customers will be notified within 72 hours as required under PIPEDA. We maintain an incident response plan reviewed annually.

We conduct internal security reviews on each major release.