Security and compliance

Our posture, plainly

carilys is built in Quebec for Quebec families. The product's technical controls are designed around the requirements of Quebec's Law 25 and PIPEDA for the protection of personal information. carilys holds no independent certification (SOC 2, ISO 27001) and claims no regulatory compliance: such statements require a legal review and an external audit, which have not yet taken place. This page describes technical controls and their actual state, with the date of the last review. It contains no scores.

• We do not display badges for laws we are not subject to. HIPAA is a US law with no triggering fact for carilys; we do not claim it.
• We do not say "all your data is AES-256 encrypted", "hospital-grade security" or "100% in Canada". None of those sentences is true as written; the reality is described below.
• Every statement on this page maps to a dated verification in our internal control register. When something is not done yet, we say so.

The company

carilys is a product of Technologies Karibew inc., a corporation incorporated in Quebec.

• Legal name: Technologies Karibew inc.
• Quebec enterprise number (NEQ): 1178437514
• Head office: Québec City, Quebec, Canada
• Person in charge of the protection of personal information: reachable at privacy@carilys.app. Every access, correction or deletion request is handled by a person, not an automated feature.

The data we process

carilys exists to organize care. It therefore processes health information, and we name it rather than calling it "account information".

• Identity and contact: name, email and phone number of care circle members.
• Family relationships and care circle membership, with each member's role.
• Health information about the person receiving care: medications, schedules and dose confirmations, diagnoses, allergies, appointments, care notes, verification call outcomes and the text transcript of those calls.
• Health information about the caregiver: mood check-ins and strain assessments, private to their author.
• Documents uploaded by the family (medical, insurance, legal); health insurance and private insurance numbers.
• Derived information produced by the system (medication adherence, escalations, call outcomes). We treat it as health information, because it is.

Where the core of the application is hosted

The application core of carilys is hosted on Google Cloud in the Montreal region (northamerica-northeast1). Verified by command on September 9, 2026:

• Database (Firestore): Montreal.
• Document and photo storage: Montreal.
• Server functions, without exception: Montreal.
• Real-time call bridge and help assistant: Montreal.
• The former US hosting project, used during development, was deleted on September 9, 2026. It contained no real user data.

What leaves Canada

Some features rely on providers that process outside Canada. We name them rather than hide them. These are transfers we are working to reduce; the state below is today's.

• Conversational verification calls: the audio of the person called is processed by our artificial-intelligence provider (OpenAI) in the United States, with the instruction not to retain content. A replacement processed in a Canadian region is under evaluation.
• Telephony: calls go through our telephony provider (SignalWire), whose processing region is not confirmed in writing. A migration to a provider offering storage in Canada is under way.
• Text-to-speech for call scripts: Google Cloud, a service with no Canadian endpoint. The synthesized text contains a first name and a dose time, never a diagnosis.
• Invitation emails: a global email service (Google Workspace). A replacement by a Canadian-region service is planned.
• Push notifications: Apple and Google, depending on the device. The content sent contains no health information.
• Crash reports: Google, only if you turn them on in Settings (off by default), and without health information.

Encryption

What encryption covers, and what it does not.

• In transit: all communications between the app and our servers are encrypted (HTTPS).
• At rest: data is encrypted by our infrastructure provider (Google Cloud), with its keys, not ours.
• Additional application-level encryption: two fields, the health insurance number and the private insurance number, are encrypted by carilys before being stored (AES-256-GCM, key derived per care circle). They exist in clear text neither in the database, nor in a backup, nor in the admin console.
• This is not end-to-end encryption: our servers can derive a circle's key. We do not claim otherwise.

Authentication and access control

The access boundary in carilys is the care circle: nobody enters without being invited, and removing a member cuts their access.

• Accounts managed by Firebase Authentication; the app locks locally with biometrics or a PIN and after a period of inactivity.
• Access to a family's data is enforced server-side by database rules covered by automated tests, including tests that verify a member of one circle cannot read another.
• Removing or suspending a member immediately cuts their access to the circle's data.
• A member cannot raise their own role. The observer role cannot modify health information.
• The carilys admin portal deliberately excludes clinical content: it sees accounts and circles, not medications or care notes.
• A very small number of people administer the infrastructure and, as a result, technically have access to the hosted data. That access serves technical support, security and our legal obligations, never anything else.

Verification calls

Verification calls are off by default and only turn on with explicit consent in the care circle.

• carilys does not record calls. No recording is requested from our telephony provider. What is kept is the text transcript of the exchange and the call outcome, in the family's record.
• Calls are only placed between 8 a.m. and 8 p.m. Eastern time.
• Consent is checked server-side before every call, and its exact text, version and date are kept in a register the circle can consult.
• For a person under 14, no call can be turned on without the recorded consent of the holder of parental authority, and that consent can be withdrawn at any time.
• The number of calls per phone number and per circle is capped, and an emergency switch can suspend all calls during an incident.

Artificial intelligence

The built-in assistant helps understand the app and organize care. Here are its limits, enforced by code rather than by a mere instruction.

• It gives no diagnosis and no medical advice.
• It has no access to medication data.
• It can neither confirm a dose, nor trigger a call, nor alert a relative on its own initiative: those actions come from deterministic rules, and any suggested action requires human confirmation.
• First names (person receiving care and members) are only sent to the model if the circle has enabled personalization; a minor's identity can be withheld.
• No carilys data is used to train an artificial-intelligence model, ours or a provider's.

Documents

Uploaded documents are stored in a private space, in Montreal.

• No object is public. Accessing a file requires circle membership and goes through time-limited signed links.
• A circle's files are erased with the circle.

Retention and deletion

We are establishing our retention schedule. Here is what is already applied automatically, and what deleting an account actually erases. None of these durations is presented as a legal one.

• Expired invitations: deleted 30 days after expiry. Closed escalation sessions: 90 days after closure. Orphaned call conversation states: 7 days. Anti-abuse counters: 30 days of inactivity.
• Account deletion, from the app: your profile, your mood check-ins and personal assessments, your call preparation notes, invitations you sent or received, your authentication account. A circle where you are the only member is erased entirely, documents included.
• What remains after your account is deleted: what you wrote in another person's record (notes, events, shared documents) stays in their circle, like the rest of their history. The access register, which shows who consulted a health record, is immutable by design.
• Deletion of a care circle by its lead: full erasure of the circle's data and files.
• Backups: the database is backed up daily, with 30-day retention, and can be restored to any point in the last 7 days. Backups stay in the Montreal region. The database is protected against accidental deletion. Restore test performed on September 9, 2026: point-in-time copy restored, content verified identical, copy destroyed.

Incident response

An incident response plan exists and a confidentiality incident register is kept, as Law 25 requires.

• The plan defines severity levels, distinct roles (technical and privacy), evidence preservation and a post-mortem.
• If a confidentiality incident presents a risk of serious injury, we notify the persons concerned and the Commission d'accès à l'information, as the law requires. We do not publish a numeric deadline until it has been validated by a lawyer.
• Emergency switches: calls, the assistant and other features can be suspended centrally during an incident.

Reporting a vulnerability

If you discover a security flaw, write to security@carilys.app. A security.txt file is published at the site's standard address. We acknowledge reports and we do not pursue good-faith researchers who respect families' data.