One database per client
Not a schema inside a shared database, not a tenant identifier column: a separate container per client. The separation is structural, not applicative.
Security and hosting
Your data is at your place, not at everybody's
The question an auditor asks is not "is it encrypted?", it is "where is the data, who has access to it, and how do you know another client cannot see it?". Here are our answers.
Hosting in Quebec
Your instance lives here. No reliance on a US host to make the product run, and no transfer of your records outside Quebec to operate it.
French by default
Law 96: the interface, the document templates and the support are in French first. English exists at parity in the product, for the clients who need it.
Law 25, Law 96
Your data stays in Quebec. And in its own database.
Every client has its own database. Not a schema inside a shared database, not a "tenant_id" column: a database of its own. No malformed query, no forgotten filter and no misconfigured access can leak your records to the neighbour, because they are not in the same container.
For a Law 25 compliance exercise, that is the difference between a technical explanation and a structural guarantee. And for Law 96, the interface is in French by default, not translated after the fact, not as an option.
The usual model
A shared database
One single database
Your records sit next to everyone else's. The separation depends on the code.
At OKTO
One database per client
Separate containers. The separation does not depend on the code.
Included
Dedicated container
Your instance and your database run in their own container, on a shared host in Quebec. That is the default mode.
+40 $ / month
Dedicated virtual machine
Your instance alone on its own VM. For clients whose internal policy requires it.
Included
Your data stays exportable
A full export of your data on request, at any time. You are never held hostage by the product.
How it works
From signature to switchover
Three steps, no surprises, with a human being in Trois-Rivières on the other end of the line.
- 01
We build your instance
A dedicated container, or a dedicated virtual machine if your internal policy requires it. Your database is created empty, for you alone.
- 02
We put your data in it
From your spreadsheets or from your current PSA. We do the transfer and we validate the result with you before the switchover.
- 03
You keep control
Your data is exportable at any time, in a readable format, on request and at no charge.
The written commitments
The data processing agreement, the terms of use and the service commitment set out the accesses, the timeframes and who is responsible for what.
Security, questions
Security questions
The ones a compliance officer asks first.
Your question is not here?
Write to us. Someone in Trois-Rivières answers, not a chatbot, and the answer comes in less than one business day.
Ask your questionIt means no malformed query, no filtering bug and no misconfigured access can expose one client's data to another: it is simply not in the same database. For a Law 25 compliance exercise, that is the difference between a technical explanation and a structural guarantee.
Two. By default, a container dedicated to your company on a shared host, in Quebec. As an option, a fully dedicated virtual machine, at 40 $ more per month. In both cases, your database is yours alone and it lives in Quebec.
Operational access is limited to the people who run the infrastructure, and every action is logged. The full commitments are set out in the data processing agreement.
The integrations you turn on yourself talk to the services concerned: Stripe for collecting payment, QuickBooks for accounting, Microsoft Entra ID or Google for signing your clients into the portal. Those are your choices, turned on by you, and the product works without them.
A particular requirement in your internal policy?
Dedicated virtual machine, installation on your own servers, precise contractual framing: let us talk about it before you sign, not after.
OKTO Solutions, Trois-Rivières, Quebec