Security and privacy at Vectac.
This page documents where your data resides, how it is protected, which third parties process it, and what is transmitted to OpenAI when the optional reporting assistant is enabled. It is written to be reviewed, and we are glad to answer anything it does not cover.
Where your data resides
The TrackBeam application and its database run on Microsoft Azure in the Canada East region — Microsoft’s datacentre in Quebec City. Your engagements, timesheets, clients and billing data are stored in Quebec.
Two services process data outside Quebec. Stripe handles subscription payment. OpenAI supports the optional reporting assistant, and only where a firm has chosen to enable it. Both are detailed below. All other data remains in Quebec.
Encryption
In transit — Traffic between your browser and TrackBeam is protected with HTTPS/TLS.
At rest — The database uses Azure SQL Transparent Data Encryption (AES-256).
These are the encryption protections provided by the Azure platform, described as such.
Backups and recovery
Azure SQL performs automated backups with a 30-day point-in-time restore window. A test restore has been carried out to confirm the procedure.
Availability
We commit to 99.9% uptime.
Access control
Two-step verification
TrackBeam supports code-based two-step verification at sign-in.
Role-based permissions
Permissions are enforced server-side, at the module level, so a user reaches only the areas their role provides for.
Authentication operated in-house
Authentication is operated in-house rather than through a third-party identity provider, which keeps your credentials within the same infrastructure as the rest of your data.
Subprocessors
The following third parties may process data related to your firm. The list is short by design.
| Service | Purpose | Processing location |
|---|---|---|
| Microsoft Azure | Application hosting and database | Quebec (Canada East) |
| Stripe | TrackBeam subscription billing | Outside Canada |
| OpenAI | Optional reporting assistant | Outside Canada |
Transactional email is limited to account creation, confirmations and password resets. It carries no engagement, timesheet or client financial data.
The optional reporting assistant and OpenAI
TrackBeam includes an optional assistant that produces reporting. It is supported by OpenAI, and enabling it means pseudonymized data related to your firm is processed outside Quebec. Your firm decides whether to use it, and that decision should be made with a full understanding of what it involves. The details follow.
Optional, and for reporting only
The assistant produces reporting and nothing else. TrackBeam does not require it: engagements, timesheets, billing and prioritization all operate without it, and prioritization in particular is rule-based and remains entirely on our Quebec infrastructure. A firm that does not enable the assistant is not concerned by this section.
What is transmitted
Amounts, hours, rates, dates, task names, service names and roles.
Pseudonymized
Records are associated with internal codes rather than client identities. Client names are not used as the key.
Not used for training
This data is not used to train OpenAI models.
Retention by OpenAI
We do not hold a confirmed zero-retention arrangement with OpenAI. Under its standard API terms, data may be retained for up to 30 days for abuse monitoring. We state this so your firm can assess the transfer on accurate information.
A residual consideration
Task names are free-text fields. If a client’s name is entered into a task name, it is transmitted with the rest. Pseudonymization protects the identifiers under our control; it cannot govern what a user enters in an open field. We recommend that firms use client codes in task names and record that practice in their internal procedures.
Under Law 25
Pseudonymized data remains personal information, and OpenAI processes it outside Quebec. Law 25 requires a privacy impact assessment for that transfer, and we have completed one covering it.
Retention and export
Retained for 2 years after cancellation
Following cancellation, your data is retained for two years, so a firm that returns or needs to reopen a prior engagement still has its records.
Export
You can export an Excel file of all recorded timesheets, with their services and tasks, by user.
Certified infrastructure
TrackBeam runs on Microsoft Azure in the Canada East region, on infrastructure that holds SOC 2 and ISO 27001 certifications. The platform controls covered by those audits — physical security, network isolation, encryption at rest, backup integrity — are the controls protecting your firm’s data. These certifications are held by Microsoft and cover the infrastructure on which TrackBeam is built.
Quebec’s Law 25 requires a named person accountable for the protection of personal information. At Vectac, that person is:
Martin Maheux, CPA, MBA
Privacy Officer, Vector Accounting Technologies inc.
You may write to him directly regarding access requests, corrections, complaints, or any question concerning this page.
Evaluate TrackBeam over a full engagement cycle.
Eight weeks, up to seven users, at no charge. Every record entered during the pilot is retained, and carries over if your firm continues.
No payment details are required to begin the pilot.