One database per client
Not a schema inside a shared database, not a tenant identifier column: a separate container per client. The separation is structural, not applicative.
Security and hosting
Your data is at your place, not at everybody's
The question an auditor asks is not "is it encrypted?", it is "where is the data, who has access to it, and how do you know another client cannot see it?". Here are our answers.
Hosting in Quebec
Your instance and its dedicated database are hosted in Quebec. Traffic goes through the Cloudflare protection network, and a backup copy is kept off site, in Canada.
French by default
Law 96: the interface, the document templates and the support are in French first. English exists at parity in the product, for the clients who need it.
Law 25, Law 96
Hosted in Quebec. In a database dedicated to your company.
Every client has its own database. Not a schema inside a shared database, not a "tenant_id" column: a database of its own. No malformed query, no forgotten filter and no misconfigured access can leak your records to the neighbour, because they are not in the same container.
For a Law 25 compliance exercise, that is the difference between a technical explanation and a structural guarantee. And for Law 96, the interface is in French by default, not translated after the fact, not as an option.
The usual model
A shared database
One single database
Your records sit next to everyone else's. The separation depends on the code.
At OKTO
One database per client
Separate containers. The separation does not depend on the code.
Included
Dedicated container
Your instance and your database run in their own container, on a shared host in Quebec. That is the default mode.
+40 $ / month
Dedicated virtual machine
Your instance alone on its own VM. For clients whose internal policy requires it.
Included
Your data stays exportable
A full export of your data on request, at any time. You are never held hostage by the product.
Built into the product
Five protections the software provides itself
What the software already does for your offline copies, received files, sessions, payroll and the passwords you hand over.
Offline, with no payroll data and no SIN
Offline mode lets you view the dashboard, projects, clients, quotes, invoices, inventory and purchases when the network drops, on computer, tablet and phone. The copy kept on the device holds no payroll, banking or Social Insurance Number data. It refreshes every 30 minutes while the network is up, and it is erased at sign-out.
It is an option the administrator turns on.
Antivirus and a 30-day quarantine
OKTO Transfer lets your clients send you files, even very large ones, without an account. Every file received is checked by an antivirus. A dangerous file is encrypted and held in quarantine for 30 days, then erased. An administrator can release it if it was a mistake.
A file over 1 GB is not scanned. The antivirus is a service of the instance, turned on at setup.
Your sign-in token stays out of the address
For live updates, the application and the client portal no longer send your sign-in token in the web address, where it would show in the Network tab and in logs. They ask for a single-use ticket, valid for 60 seconds, and present that instead.
Payroll details, never in plain text
A new employee's full SIN and date of birth go to the accountant through a protected link, valid for 7 days. The password arrives separately, by text message or a second email.
The payroll report sent to the accountant does not carry the full SIN. The hourly rate and file notes only show to people with the right permission.
Details are on the HR and payroll software page.
Secret notes that erase themselves
A password or a code you hand to a client no longer travels in plain text in an email. The note is encrypted and protected by a password you give out loud. It erases itself after the delay you pick, from 24 hours to 30 days, or on first reading, and you can revoke it before then.
The module is turned on by OKTO, on request.
Accounts and access
What protects each account and each session?
These protections are in place in every instance. Nobody has to turn them on.
Foreign scripts are refused
The browser refuses any script that does not come from your OKTO PSA. A booby-trapped page cannot read your session.
Two-factor authentication cannot be bypassed
A password reset link can no longer skip the two-factor authentication code.
Sign out of every device
Changing your password or resetting two-factor authentication signs out your other devices. The "Sign me out everywhere" button does the same on request.
Everyone within their role
A technician cannot edit colleagues' tickets and only submits their own timesheet. Exports and the consent register are limited to authorized roles.
Invoices that stay put
An invoice that is paid or sent to QuickBooks can no longer be edited: the correction goes through a credit note. Every change to a sent invoice is logged.
The portal opens with a link
A client's first sign-in to the client portal goes through a link received by email, never through a password set blindly.
Drafts without secrets
Notes, quotes, emails and records keep what you wrote if you close before sending. Passwords, codes, cards and keys are never kept.
A server kept up to date
The server platform and its components are kept up to date. The server runs without administrator rights in its container, and a copy of the database is taken before every migration.
Email and text messages
How does OKTO PSA respect your clients' consent?
A commercial email or text message must respect what the person agreed to. OKTO PSA checks it at sending time.
One-click unsubscribe
Campaign emails offer one-click unsubscribe, right in the person's email client. Campaigns sent through Microsoft 365 offer it too.
Text messages that say who is writing
Every text message starts with your organization's name, and text consent is checked before sending.
Consent with proof
An imported "yes" consent with no date or proof is recorded as implied. When two records are merged, the do-not-contact choice is kept.
Email security, available on request
Turned on by OKTO on request, it reads the DMARC reports of your domains and your clients' domains every 15 minutes: 30-day compliance, unknown senders, spoofing alerts. The DMARC manager sets the policy, SPF and DKIM, with a preview before writing and a one-click rollback.
How it works
From signature to switchover
Three steps, no surprises, with a human being in Trois-Rivières on the other end of the line.
- 01
We build your instance
A dedicated container, or a dedicated virtual machine if your internal policy requires it. Your database is created empty, for you alone.
- 02
We put your data in it
From your Excel spreadsheets or from your current software, PSA or other. We do the transfer and we validate the result with you before the switchover.
- 03
You keep control
Your data is exportable at any time, in a readable format, on request and at no charge.
The written commitments
The data processing agreement, the terms of use and the service commitment set out the accesses, the timeframes and who is responsible for what.
Security, questions
Security questions
The ones a compliance officer asks first.
Your question is not here?
Write to us. Someone in Trois-Rivières answers, not a chatbot, and the answer comes in less than one business day.
Ask your questionIt means no malformed query, no filtering bug and no misconfigured access can expose one client's data to another: it is simply not in the same database. For a Law 25 compliance exercise, that is the difference between a technical explanation and a structural guarantee.
Two. By default, a container dedicated to your company on a shared host, in Quebec. As an option, a fully dedicated virtual machine, at 40 $ more per month. In both cases, your database is yours alone and it lives in Quebec.
Operational access is limited to the people who run the infrastructure, and every action is logged. The full commitments are set out in the data processing agreement.
Traffic to your instance goes through the Cloudflare protection network, run by a US company, and a backup copy is kept off site, in Canada. The integrations you turn on yourself talk to the services concerned: Stripe for collecting payment, QuickBooks for accounting, Microsoft Entra ID or Google for signing your clients into the portal, and the AI provider you choose if you turn on OKTHAV. Those are your choices, turned on by you, and the product works without them. The list of subprocessors is in the data processing agreement.
A full export of your database is handed to you before your instance closes, and its destruction is then attested to in writing. This mechanism already exists, whichever delivery mode you chose.
A particular requirement in your internal policy?
Dedicated virtual machine, installation on your own servers, precise contractual framing: let us talk about it before you sign, not after.
OKTO Solutions, Trois-Rivières, Quebec