Security
This page describes what we actually do, not what would sound reassuring. Where a control does not exist yet, it says so.
What we hold, and for how long
Almost nothing, deliberately. To order an Ontario 3-year driver record the ministry needs one thing: a driver's licence number. So that is what we ask for, plus an email address to reach you and the province you live in.
We do not ask for your date of birth, your address, your name as it appears on the licence, a photograph, a scan of anything, or a document of any kind. Not because they would be hard to store, but because we would then be storing them.
| What | Why we have it | How long |
|---|---|---|
| Driver's licence number | The ministry needs it to find the record | Deleted 30 days after the order closes |
| Email address | To send your receipt and reach you about the order | Retained with the order record |
| Province of residence | To refuse orders we cannot lawfully serve | Retained with the order record |
| Order reference, amounts, status history | Accounting, and evidence if a payment is disputed | Retained; card dispute windows reach 540 days |
We never hold anything physical
There is no envelope in this service in either direction. You post nothing to us, we post nothing to anybody, and the ministry emails the finished record to you directly. There is no document to lose, no courier to trust and nothing for us to be responsible for the safekeeping of, because we never take possession of anything.
Card details
Your card number never reaches us. Payment runs on Stripe's hosted checkout page, on Stripe's own systems. We receive a confirmation that a payment succeeded and an identifier for it. We never see, store, log or transmit a card number, an expiry date or a security code, and there is no part of this service where a person at this company re-types your card into anything.
That is a deliberate architectural choice rather than a policy: the payment page is not ours, so there is nothing for us to mishandle.
Encryption
The licence number is encrypted at rest with AES-256-GCM under a key derived per record, so a value taken from one order cannot be decrypted under another. Everything in transit is over TLS. Our marketing pages ship no JavaScript at all and load nothing from any third party, which is why they can enforce a content security policy that permits nothing by default.
Who can look at your data
Order data is opened through a named operator account. Every time a licence number is decrypted, the system records who did it, when, and against which order. Each operator has a daily cap on how many orders they can open, and it fails closed: past the cap, the console stops rather than warning.
The operator console is not reachable without both a proxy-authenticated identity and a separate shared secret. If the secret is not configured in production the console is off, and the request is refused before any code opens the database.
Where your data is
In the United States. That matters and it is not buried: information stored and processed there may be accessed by US courts, law enforcement and national security authorities under US law, and no contract we sign changes that. Canada's federal privacy law requires you to be told this, not to consent to it, and you are told it at the point you type the number rather than afterwards.
Retention, and why it is short
The licence number is deleted 30 days after your order closes, by a job that runs whether or not anyone remembers. The order record itself survives longer, because card dispute windows reach 540 days and we would otherwise be unable to answer a chargeback. What survives is the evidence of what happened, not the personal data it happened to.
Reporting a vulnerability
Email support@driversabstract.ca. We will acknowledge within two business days and tell you what we are doing about it.
If you follow the ordinary rules — stop as soon as you have demonstrated a problem, do not access or modify anyone else's data, do not degrade the service, and give us reasonable time before publishing — we will not pursue you and we will say publicly that your work was invited.
If something goes wrong
If personal information is exposed, we will tell the people affected and the relevant regulator, with what happened, what was involved and what we are doing. We would rather tell you about a small incident than be found not to have told you about one.
What we do not have
Stated plainly, because a security page that lists only strengths is not a security page.
- No SOC 2 report and no ISO 27001 certificate. The company is new and has neither.
- No formal penetration test yet.
- No 24-hour staffed security response. We are small and we answer during the hours we publish.
- No bug bounty, only the coordinated-disclosure commitment above.
None of that is a reason to distrust the design, and none of it is a substitute for the design. The strongest thing we can say about the security of your data here is how little of it there is and how briefly we keep it.