Legal
Data processing agreement
The agreement governing OKTO's processing of the information you entrust to the product on behalf of your own clients.
In effect as of September 4, 2026. Any significant change is communicated to clients before it takes effect.
Document outline
Roles of the parties
The client decides, OKTO carries out on their behalf.
The client is the business that decides the purposes and the means of processing the personal information placed in its instance. OKTO Solutions acts as a service provider and processes that information solely on the client's behalf and according to its instructions, within the meaning of section 18.3 of the Quebec statute.
OKTO Solutions does not use that information for its own purposes, does not disclose it to anyone without the client's mandate, and does not keep it beyond what the contract provides.
Nature and purpose of the processing
Categories of data and of individuals concerned.
The processing consists of hosting, keeping, backing up, restoring and making accessible the information placed in the instance, as well as providing the technical support the client requests.
The categories of information include, among others: business contact details, service request histories, billing and payment documents, timesheets and, if the client turns on the human resources module, information about its employees.
Security measures
Isolation through a dedicated database, access control, logging.
Each client gets its own database and its own runtime environment. The separation is structural, not applicative: there is no table shared between clients.
Exchanges are encrypted in transit. Backups are encrypted at rest. Access by OKTO Solutions staff is individually named, limited to what is strictly necessary, and logged. Multi-factor authentication is available for client accounts.
The product keeps an audit log of accesses and changes, which the client can consult.
Subsequent subcontractors
A list kept current, with notice before any change.
OKTO Solutions may use subcontractors for hosting, network protection and backup storage. The current list is attached to the contract and provided on request.
Each subcontractor is bound by commitments at least equivalent to those in this agreement. Any addition or replacement is communicated to the client with reasonable notice, and the client may object on serious grounds related to the protection of information.
Confidentiality incident
Notice timing and terms, obligations under Law 25.
OKTO Solutions notifies the client without delay as soon as it has reason to believe a confidentiality incident has occurred, passes on the information it holds, and assists the client in assessing the risk of serious injury and in issuing the required notices.
OKTO Solutions records the incident in its register and keeps it for five years.
Assistance to the client
Requests for access, correction and portability.
When an individual exercises their rights with the client, OKTO Solutions provides the client, within a reasonable time, with the technical means to respond: extraction of the information concerned, correction, deletion or disclosure in a structured, commonly used format.
End of processing
Returning and deleting the data.
At the end of the contract, OKTO Solutions returns all the information to the client in a readable format, then securely destroys it along with the corresponding backups, within the timeframes set out in the terms of use. A certificate of destruction is provided on request.
The other documents
A question about the contractual framework before these documents are published? Write to us and we will tell you where things stand.