Trust Center

When you visit our website, fill out a form, apply for a job or do business with us, Multiply decides how that information is used and is responsible for it under our Privacy Policy.

When we follow up with leads or customers for a client business, that client decides how the information is used. We use it only to provide the service they hired us for, under a written agreement, and forward any privacy request we receive to them.

• A designated Privacy Officer with published contact details
• A register of confidentiality incidents; the Commission d’accès à l’information and affected people are notified when there is a risk of serious injury
• Privacy impact assessments for new projects and before personal information is communicated outside Québec
• Retention and destruction rules for every type of information

• The ten fair information principles applied to how we collect, use and disclose information
• Breaches with a real risk of significant harm reported and recorded

• Valid consent before commercial electronic messages
• Sender clearly identified in every message
• A simple way to unsubscribe in every message

• Consent requirements under the TCPA followed for US contacts
• Opt-out requests honoured across programs

• Confidentiality commitments. All personnel accept confidentiality obligations during onboarding and when policies are updated.
• Security policies and ownership. Policies are reviewed at least once a year, with named owners and version control.
• Background screening. Role-appropriate checks for new hires, in line with local laws.

• SSO and MFA. Centralized identity with multi-factor authentication for privileged access.
• Least-privilege access. Access is granted by role; quarterly reviews remove stale permissions.
• Joiners, movers and leavers. Access changes automatically on hire, role change and offboarding.

• Asset inventory. Devices, systems and data stores are tracked with an owner and a classification.
• Hardening and patching. Security baselines with timely updates and automatic patching.
• Device encryption. Full-disk encryption on company-managed laptops and phones.

• Classification and handling. Defined data categories with rules for storage, access and sharing.
• Retention and disposal. Retention schedules applied; secure erasure on request and at end of life.
• Client data separation. Logical separation of client data and least-access principles across environments.

• In transit. TLS 1.2 or higher for external connections, with HSTS where applicable.
• At rest. Industry-standard encryption with managed keys for databases and backups.
• Key management. Periodic key rotation, with restricted access and audit logs.

• Anti-malware and EDR. Real-time protection and telemetry, with alerts reviewed.
• Screen lock. Automatic lock enforced and disk encryption required.
• Removable media. Restrictions on USB and peripherals, with documented exceptions.

• Segmentation and firewalls. Least-access rules between tiers and services.
• Secure remote access. SSO and MFA for administrators; no direct production access without approval.
• Traffic monitoring. Inbound and outbound logging with anomaly alerts.

• Code review and CI checks. Peer review, with automated tests and secret scanning.
• Dependency management. Automated vulnerability alerts and timely updates.
• Development policy. Documented stages from design to release, with security gates.

• Change tracking. Every production change is recorded with sign-off and a rollback plan.
• Emergency changes. A defined process with a review after implementation.

• Centralized logs. Critical system logs are aggregated, with retention and access controls.
• Alerting. Alerts on suspicious activity and failed sign-in attempts.

• Response plan. Defined roles, severity levels and communication templates.
• Annual exercise. The plan is rehearsed every year and lessons are recorded.
• Notification. A process to inform affected clients, individuals and authorities as required.

• Tested backups. Regular backups, verified through restore tests.
• Recovery objectives. Documented recovery time and recovery point objectives.

• Vendor due diligence. Security assessments for new vendors; higher-risk vendors reviewed every year.
• Written agreements. Providers are bound by written agreements that limit how they use information and require them to protect it.

• Scanning. Regular scans of applications and infrastructure, with risk-based timelines.
• Remediation tracking. Fixes are tracked to closure, with verification and change control.

Some of our service providers may store or process information outside Québec, including elsewhere in Canada or in the United States. Before information leaves Québec, we assess whether it will be adequately protected. The list of providers and where they store data is available on request.

We keep personal information only as long as needed for the purpose it was collected for, or longer if the law requires it. For client programs, retention is set in each client agreement. Our retention schedule is available on request.

People can ask to access or correct their information, withdraw consent, or ask us to stop disseminating it, where the law allows. Requests go to our Privacy Officer and are answered within 30 days.

For legal, procurement and security teams

Documentation on request

Tell us what your review needs and we’ll send it.