// Pliris StudiosTrust and compliance

Compliance first

The Pliris Intelligence Platform is built for public bodies in British Columbia and across Canada. Privacy law, records, and accountability were the starting requirements, not a checklist added before launch.

Most software reaches the public sector late. It is built for a private market, then handed to a privacy officer with a questionnaire and a deadline. The answers are often “it depends” and “that is on the roadmap.”

We started from the other end. Pliris works with public bodies every day, so the platform began with the questions a privacy officer asks: where is the data, who can see it, what is recorded, and how do we get it back.

// Stance

Your obligations were our requirements

A public body cannot hand its privacy duties to a vendor. What a vendor can do is make those duties easy to meet and easy to show. That is the job we gave the platform before we wrote the first product on it.

Compliance first
Access rules, the audit trail, and workspace separation sit in the foundation. Every product inherits them, so a new product cannot arrive without them.
Sovereign by design
Your records are designed to stay in Canada, in a workspace that belongs to your organization alone, under an agreement governed by Canadian law.
Shown, not claimed
Security is tested on every change by a suite that behaves like an attacker. We share the results and the documents your privacy officer needs.
// Sovereignty

What sovereign means here

Sovereign is an easy word to print. These are the commitments behind it.

Data stays in Canada
The application, the database, and the backups are designed to run in Canadian data centres. No copy is kept elsewhere.
A workspace of your own
Each organization has its own separate database workspace. Another customer's query cannot reach your tables, and ours cannot mix them.
No foreign processing by default
AI assistance is an optional add-on and is off by default. With it off, no record leaves the platform for a third-party service.
No lock-in
Export your records to Excel or CSV at any time. At the end of a contract we return your data and delete our copies, in writing.
No tenant code
Customers shape the platform with settings, never with their own SQL or scripts. One workspace cannot be turned into a way in to another.
A Canadian company
Pliris is based in British Columbia. Your agreement, your support, and your point of contact are here.

Ask us where the service is hosted and who operates the data centre. We will tell you the provider, the region, and the corporate ownership, so your privacy impact assessment rests on facts.

// British ColumbiaFOIPPA

How the platform supports FOIPPA

The Freedom of Information and Protection of Privacy Act puts the duty on the public body. This is how the platform helps you meet it and show that you have.

Your duty How the platform helps

Protect personal information with reasonable security

Section 30

Role-based and row-level access on every screen, export, and printout. Multi-factor sign-in, account lockout, and single sign-on with your Microsoft 365 tenant. Encrypted connections. An adversarial test suite on every change.

Know where personal information is stored and assess it

Privacy impact assessments, section 69

Canadian data residency by design, and a plain description of the hosting, the data flows, and the subprocessors for your assessment.

Use and disclose only what is needed

Sections 32 and 33

Each role sees the rows its work requires. A risk owner sees their own risks, a manager sees the register, an executive reads. Reports follow the same rules as screens.

Keep information accurate and correct it on request

Sections 28 and 29

Required fields, validation rules, and approval steps at entry. Every correction is recorded with who made it and when.

Retain information used to make a decision

Section 31

Closing a record keeps it. History is never overwritten, and the activity log is kept for a set retention period agreed with you.

Respond to access requests

Part 2

Search across records, filtered exports, and printable reports help your records staff find and produce what a request covers.

Detect and report a privacy breach

Section 36.3

An activity log of sign-ins, changes, and exports shows who touched what. We notify you without delay of any incident that affects your workspace.

Run a privacy management program

Section 36.2

Named roles, documented access rules, and an audit trail give your program evidence instead of assurances.

This summary is not legal advice. FOIPPA compliance is the responsibility of the public body, and no software makes an organization compliant by itself. Check the Act and your own privacy officer's guidance.

// Also

Beyond FOIPPA

Other provinces and federal bodies
The same controls support public bodies under other Canadian privacy laws. Tell us which Act applies and we will map it with you.
Accessibility
We build toward WCAG 2.1 AA for the Accessible British Columbia Act: keyboard access, skip links, readable contrast, and layouts that work on a phone. An independent review is planned before general release.
Records and audit
Changes are logged with who and when. Reports of record carry a period, an as-of date, and a sign-off block.
Emergency and Disaster Management Act
The Risk Management package for BC local government tracks the three documents the Act asks for, each with its own review clock.
// Procurement

What we give your privacy officer

Procurement goes faster when the answers arrive before the questions.

  • A description of the architecture, hosting, and data flows, written for a privacy impact assessment
  • A list of subprocessors and where each one operates
  • A summary of security controls and the latest adversarial test results
  • Our incident response and breach notification commitments
  • Data return and deletion terms for the end of a contract
Where we are

The platform is in early access. We do not yet hold a third-party certification such as SOC 2, and we will not imply one. Early participants review these documents with us directly.

// Pliris Studios

Bring your privacy officer to the first call

We would rather answer the hard questions at the start than at the contract.