Maintenance Records in Canada: Questions for Vendors

You are on the third demo of the week. The rep is clicking through work orders, and you ask a simple question: where does our data live, and who can see it? The answer is a smile and "we take security very seriously." That is not an answer. If you are shopping for PIPEDA maintenance software Canada operators can defend to an insurer or franchisor, written answers matter more than badges.

This post is a list of questions, not a legal opinion. No software can make you compliant on its own. Your obligations depend on your province, your business structure and your contracts, so confirm the details with a privacy lawyer or your franchisor's counsel. Use the list on any provider, including us.

Why maintenance records are personal data

A work order about a walk-in cooler is not a medical file. But look at what a typical record contains:

• Names, emails and phone numbers of your store managers and staff.
• Names and contact details of the contractor's dispatcher and technician.
• Photos taken in the back room, which can include employees, screens or paperwork.
• Free-text notes such as "manager away on leave" or "called Dave at home."
• Timestamps that show who was on site, and when.

Under PIPEDA, information about an identifiable individual is personal information. If your company handles it in the course of commercial activity, the law's principles generally apply, and a provider handling it for you does not remove your accountability. Provincial laws, Quebec's in particular, may add to this. Check with counsel.

PIPEDA maintenance software Canada: the questions to ask

Send these in an email, not as chat during a demo. Written answers are what you keep.

Where is the data stored and processed?

Ask for the hosting regions in writing, including backups, file storage and any email or notification service. Cross-border processing is not automatically a problem, but your privacy notice and contracts may need to say it happens. If the answer is "it depends," ask what it depends on.

Who are the subprocessors?

A subprocessor is any other company that touches your data: cloud hosting, email delivery, payments, analytics. A good provider can list them and tell you how you will hear about changes.

Who inside the provider can see our records?

Ask which staff can open your account, under what circumstances, and whether that access is logged.

What access controls exist for our own people?

A store manager does not need to see another site's records. Ask how roles work and whether they can be restricted by location. In Concoct, store managers can be limited to their own location, owners see everything, and operations managers see the whole organisation. There is no region-only view for managers today, so if you need one, factor that in.

How do contractors get access, and for how long?

Many contractors will not log into another app, so providers often hand them a link. Ask what that link exposes, how long it lives, and what happens when the job closes. In Concoct, the vendor portal is passwordless: one emailed link per work order per recipient, scoped to that one job. It stops working when the job is closed or cancelled, and expires after 14 days. Links go by email only. That is a trade-off, and you should weigh it the way you would weigh anyone's.

What happens if there is a breach?

PIPEDA has breach-of-security-safeguards rules: organisations are expected to assess breaches for a real risk of significant harm, report and notify where that threshold is met, and keep records of breaches. Ask the provider how they would notify you, how fast, and what information you would get so you can meet your own duties. Ask for the commitment in the contract, not a brochure. Confirm thresholds and timelines with counsel.

How long do you keep our data, and can we delete it?

Retention is one of the privacy principles. Ask how long records are kept while you are a customer, what happens after you leave, and whether you can request deletion. Also ask what happens when a single user is removed.

Can we get our data out?

Ask for an export in a standard format, what it includes, and whether there is a fee. Import and export are not always symmetrical. Concoct can import equipment and vendors from a spreadsheet, so ask us about the export path too. Test it during your trial with real records, not sample ones.

What do you certify, and what do you only describe?

This separates marketing from fact. Ask for any third-party audit reports by name. If a provider says "compliant," ask: compliant with what, assessed by whom, and when?

Here is our own answer, as far as we can state it in a blog post. Our privacy policy says data is processed and stored in Canada and the United States, so it is not Canada-only. We make no certification claim, including SOC 2 or ISO. Read the policy itself, and ask us in writing for anything it does not cover. If your franchisor or insurer requires one, we are not the right fit today, and it is better to know that now.

How to run the process without a legal team

1. Send the same questions to every provider on your shortlist, in the same words.
2. Put the answers side by side. Silence and vague answers count as answers.
3. Read each privacy policy and set of terms yourself. Ours are on the terms page. Compare what they say about data, deletion and breaches with what the rep told you.
4. Show the answers to your franchisor, insurer or counsel before you sign.
5. Test the export and a deletion request during the trial.

If you are comparing how providers charge at the same time, our piece on per-seat versus per-location pricing covers the money side. If contractor access is your main worry, how to manage vendors who refuse to log in explains the link-based model in more detail.

Next step

Prices are public on the pricing page, so you can check cost before you talk to anyone. If you would rather put these questions to us directly, book a demo and bring the list.

FAQ

Does PIPEDA apply to maintenance records?

It can. Work orders often include names, contact details, photos and notes about identifiable people, and PIPEDA generally covers personal information handled in commercial activity. Provincial laws may also apply. This is not legal advice, so confirm how it applies to your business with counsel.

Is "PIPEDA compliant" a certification I can ask for?

Not that we know of. We are not aware of an official PIPEDA certificate for software. A provider can describe how it handles personal information, agree contract terms and answer written questions. Be cautious of anyone who presents a badge as proof, and ask what was assessed and by whom.

Do I need the data stored in Canada?

PIPEDA does not generally require it, but you stay accountable for data wherever it is processed, and you may need to be open about cross-border handling. Some contracts, franchisors or provincial rules may ask for more. Ask where data is hosted and check your own obligations.

What should I do with old records when a manager leaves?

Decide it in advance. Remove their access straight away, and ask your provider how a removed user appears on historic work orders. You will usually want the maintenance history kept, with a clear policy on how long personal details attached to it stay.

Does Concoct hold any security certifications?

Our privacy policy says data is processed and stored in Canada and the United States, and we make no certification claim, including SOC 2 or ISO. If you require one, tell us early.