Contact us
EN

Data privacy

Your product data stays in Canada and the US.

Buyers ask where the data goes and who abroad can reach it. We map every data flow, host the data in Canada and the US, separate and log access from abroad, and write the privacy notices each market requires.

Get a free exposure reviewTalk to us

Sounds familiar?

  • The buyer asks where the data goes, and the answer is a cloud abroad.

    We map every flow from device to cloud and move product and customer data to Canadian and US data centers: a private slice of servers, or a private AI server we host, so AI features run without data leaving.

  • Your engineers abroad need access to fix things.

    They see what they need. Every other access is approved and logged, and the log is ready for the buyer's IT team.

  • Quebec, Mexico and US states each want their own privacy notice.

    We write the notices for each market and the assessment Quebec's Law 25 requires before personal data leaves the province. Licensed counsel reviews them.

What we do

  • Data map for the buyer's IT team
  • Hosting in Canadian and US data centers
  • Private slice: your own isolated servers in the data center
  • Private AI server hosted by us, for AI features on your data
  • Access from abroad separated and logged
  • Privacy notices for Canada, Quebec, Mexico and US states

What you get

  • A data map your buyer's IT team can read
  • A hosting environment in Canada or the US
  • An access log for every access from abroad
  • Privacy notices for each market
  • A dated record in your evidence file

Three privacy documents, three jobs

  • Data map

    Included in Operate

    One diagram and one table of every data flow for a product line: device, app, cloud, support. For your own team and a first buyer question.

  • Data passport

    Included in the Secure setup · otherwise quoted per model

    The buyer-ready file per model: every data flow, cloud endpoint, country, retention period, subprocessor and who can reach the data. Reused in every IT review.

  • Privacy notices

    Included in Operate · counsel review of your final text at cost

    What users and regulators see: privacy notices in English, French and Spanish, and the assessment Quebec's Law 25 requires before data leaves the province.

The plan for it

Monthly, per product line. Start with the free snapshot or a one-time audit.

Data privacy

Operate

US$590 a month per product line

US$990 setup · minimum 3 months

Choose it when

  • A buyer asks where the data goes, and today the answer is a cloud abroad.
  • Your engineers abroad need access, and the buyer wants every access logged.
  • Users send privacy requests, and the law gives you 30 days to answer.

Included

  • Everything in Watch
  • Product data hosted in Canadian and US data centers: a private slice or a private AI server
  • Data map: one diagram and table of every data flow, kept current
  • Access from abroad separated and logged
  • Privacy notices for each market from counsel-reviewed templates
  • Privacy and data requests answered within 30 days
  • One new buyer questionnaire a quarter

Priced separately

  • Hosting infrastructure at cost, quoted before setup
  • Data passport per model
  • Counsel review of your final notices, at cost

All three services

Secure

US$3,490 a month per product line

US$3,200 setup · minimum 12 months

Choose it when

  • Buyer contracts ask for patch timelines, a named incident contact and yearly tests (lab tests quoted at cost).
  • You run a fleet in the field, where one bad update reaches every device.
  • You must show security evidence to regulators: EU CRA, FDA 524B, FCC.
  • You want one accountable team instead of three vendors.

Included

  • Everything in Respond (vulnerabilities) and Operate (data privacy)
  • Up to two new buyer questionnaires a month
  • Data passport for the product line, built in the setup and refreshed twice a year
  • A named security lead and a monthly 45-minute call
  • A buyer-ready report every quarter
  • 6 fix credits a month for small fixes; bigger work quoted first
  • A scan of every release and device monitoring, up to 2,000 devices
  • Incident plan and a yearly drill
  • Evidence file for buyers and regulators: EU CRA, FDA 524B, FCC
  • A first answer within one business day

Priced separately

  • Accredited lab tests at cost, quoted before each test
  • Fixes beyond your credits, quoted first
  • Devices above 2,000: from US$0.90 each a month

All plans and prices

What we commit to

  • Written scope before work starts.
  • Every deliverable dated and kept in your evidence file.
  • Vulnerability reports acknowledged within one business day; on Respond and Secure, received 24/7 with an engineer on call.
  • A first answer to any request within one business day, Vancouver time.
  • A named lead you can escalate to.

You own your product and its security. We own the work we deliver, in writing. No one can promise a site or product will never be hacked. Doing nothing is far riskier. We shorten the time you stay exposed, and we keep the record.

Tell us what you run, and what keeps you up at night.

Write in your language or in English. We reply within one business day with first questions and a time to talk; calls in English, by appointment.

Talk to ushello@norvoya.com
Contact