This page explains our approach to security, governance, privacy, and responsible AI.
Core security practices applied across the platform and all processing environments.
All information is encrypted in transit and at rest. Sensitive client data is protected through the full processing lifecycle.
Role-based permissions and multi-factor authentication govern who can access what. Access is logged, monitored, and reviewed regularly.
Processing logs are retained for audit purposes. Significant actions and data transformations are traceable and reviewable.
All incoming data enters a secure quarantine environment before processing. Pipelines operate in isolated, monitored environments to protect client information.
Defined procedures are in place to contain, investigate, and remediate security incidents. Affected parties are notified promptly in accordance with legal requirements.
Client-provided data is retained only as long as necessary to deliver contracted services or as required by law. Deletion requests are honored promptly and completely.
For legal documentation, see our Privacy Policy and Terms of Service.
Governance is not an add-on applied at the end. It is embedded in every stage of the refinery pipeline. Information entering the system arrives with a record of its origin. Information leaving the system carries a record of every transformation.
This design means every output can be explained. Every result can be traced. Every claim about the data can be verified against the process that produced it.
That is what makes governed data trustworthy rather than merely useful.
Every record is linked to the source it came from, when it was acquired, and under what authority it was ingested.
Transformation history is preserved. Any output can be traced through each processing stage back to its origin.
Processing logs are retained and reviewable. Every transformation is explainable to an auditor, a compliance officer, or a regulator.
Outputs are interpretable. Teams can understand not just what a result is, but where it came from and how it was produced.
Results can be re-derived from inputs. The processing chain is deterministic and documented, not a black box.
Client information is not a product. It is not a revenue source. It is not shared, aggregated, or monetized. It exists in the system to be processed, refined, and returned.
Submitting data to us grants a limited processing license. We do not claim ownership over any client-provided information.
Only authorized personnel can access client data. Access requires authentication, is role-limited, and is logged.
MyWaypoint does not operate an advertising business. Client information is not used for targeting, profiling, or audience building.
Client information is not sold, transferred, or shared with third parties outside the contracted service delivery.
Data is processed in controlled, isolated environments. It does not flow into shared systems where it could commingle with unrelated client information.
Clients can request deletion of their data. Deletion requests are honored promptly and completely within the scope of our legal obligations.
Most AI problems are data problems. The refinery addresses the source rather than the symptom.
Data quality before retrieval
Validate, normalize, and enrich source content before it enters any AI pipeline. The retrieval layer works with governed data, not raw content.
Attribution on every output
AI responses can be traced to the specific source records that informed them. Attribution enables human review and challenge.
Lineage across the chain
From source acquisition through enrichment and retrieval, the processing history is maintained so no step is opaque.
Reviewable processes
AI-assisted stages are logged and explainable. No processing step is a permanent black box that cannot be examined or challenged.
Client data is not used to train shared models
Information you provide is processed to deliver the contracted service. It is not used to train general-purpose AI models shared across other clients.
No unsupported AI claims
We describe what AI does in the refinery specifically — extraction, classification, context generation. We do not make broad claims we cannot support.
No black-box automation
We favor explainable systems over opaque ones. Enterprise outputs should be interrogable, not just delivered.
No AI hype
We describe what the platform does, not what it might do. We don't pitch AI as a solution to problems it doesn't address.
MyWaypoint is a Canadian company operating under Canadian privacy law and British Columbia jurisdiction. For enterprise buyers in regulated Canadian industries, jurisdiction and data residency are material requirements — not secondary considerations.
We address data residency, processing location, and legal jurisdiction directly in enterprise deployment discussions. See the About page for full company identity and legal details.
MyWaypoint Technologies Inc. Legal entity registered and operating in British Columbia.
Personal information is handled in alignment with Canada's Personal Information Protection and Electronic Documents Act.
Contracts, dispute resolution, and legal obligations are governed by the Province of British Columbia, Canada.
These are operating commitments, not aspirational statements.
We explain where data comes from.
Source attribution is attached to records — not stripped away for convenience.
We explain how information is processed.
Transformation history is maintained and reviewable, not collapsed into a single opaque output.
We maintain source attribution whenever possible.
Attribution enables trust. When an output can be verified, it earns credibility.
We value explainable systems.
A system that cannot explain itself cannot be trusted. We design for interrogability, not just capability.
We favor governance over black boxes.
Governance requires visibility. We build traceability in because audit requirements don't disappear when the system is convenient.
We believe trust requires transparency.
Trust is not built by asserting trustworthiness. It is built by operating in ways that can be observed and verified.
Any organization evaluating a data platform should ask these questions. Here is how MyWaypoint approaches each one.
Where is information processed?
Processing occurs in secure, monitored cloud environments operated by MyWaypoint. For enterprise deployments, we discuss specific data residency and processing requirements. We do not process client data through uncontrolled third-party services.
Who has access to it?
Only authorized MyWaypoint personnel under role-based access controls. Access requires multi-factor authentication, is restricted to the minimum necessary, and is logged. We do not grant broad access to client data.
Can outputs be audited?
Yes. Processing logs are retained and every transformation is traceable. Outputs include lineage and source attribution. The processing chain from input to output is reviewable and defensible.
Can provenance be traced?
Yes. Every record maintains source attribution and transformation history through the refinery pipeline. An auditor can trace any output back to the source document, the acquisition timestamp, and the processing steps applied.
Who owns the resulting information?
You do. Clients retain ownership of their data. Submitting information to us grants a limited license to process it for the contracted purpose. We do not claim ownership of client data, and we do not use it beyond the contracted scope.
How is AI grounded?
AI systems operate on refined, validated source content rather than raw data. Outputs are grounded in attributed records, so responses can be traced to specific source documents. Client data is not used to train shared AI models.
The refinery is built to handle the information types and compliance requirements that enterprise and regulated organizations face. Governance and security controls are applied consistently regardless of source type or deployment context.
Enterprise deployments are discussed in detail — including data residency, access architecture, deployment environment, SLA expectations, and integration requirements.
Supported source environments
Governance controls apply consistently regardless of source type.
If you're evaluating MyWaypoint for governance, security, procurement, privacy, or enterprise deployment purposes, we're happy to discuss the specifics in detail.
