Buchwald Services Consulting Inc. (BSC) provides software and related services for social-service organizations. This page explains our Canadian hosting, data responsibilities and AIMS safeguards, and how to request further information.
Products and scope
AIMS is the base product. TIMMS, PoliScribe Assurance, Job Tracker and Document Management System (DMS) are separately purchased add-ons. Features, deployment arrangements and security controls can differ by product. The specific controls described below apply to AIMS; please request information for the product and deployment your organization is assessing.
Canadian hosting
All BSC data is hosted and stored in Canada. AIMS uses dedicated OVHcloud infrastructure in Beauharnois, Québec. AIMS backups are also stored in Canada.
Your data and our responsibilities
The subscribing agency owns its AIMS customer data, including any personal health information it enters. BSC operates and administers the AIMS environment, including application administration, hosting operations, backups, maintenance and support. OVHcloud provides the infrastructure hosting.
Our current standard agreement limits handling of agency records to the purchased services, lawful customer instructions and legal requirements. It requires reasonable administrative, technical and physical safeguards and restricts access to personnel and authorized subcontractors who need it for those purposes and are bound by protective confidentiality obligations. It gives BSC no independent right to sell, market with or otherwise repurpose agency records. Each customer’s signed agreement governs its services.
Agencies remain responsible for the lawful collection and use of their records, their record-retention requirements and the access they authorize for their users.
AIMS safeguards and access controls
- AIMS uses HTTPS to encrypt communications between users’ browsers and the servers.
- Linux servers holding AIMS customer data use disk encryption at rest. AIMS database backups are encrypted before upload to backup storage.
- Each agency has a separate AIMS database.
- Access to BSC servers is restricted to AIMS developers using multifactor authentication (MFA).
- Agencies can enable and enforce two-factor authentication. An optional Agency PIN provides an additional verification step.
- Basic, Intermediate, Power and Administrator access levels are managed by the agency’s AIMS Administrator. Agencies can configure password rules, certain module permissions and automatic logout after inactivity.
- AIMS audit logs record login, logout, actions performed, timestamps and source IP address, and are accessible to the agency’s AIMS Administrator.
BSC staff may access customer information to troubleshoot or diagnose system issues. The encryption and access measures above describe their stated AIMS scope; they do not establish identical controls for every file, copy or other product. No system can offer absolute security.
Backups and recovery
The BSC team schedules and performs nightly AIMS database backups at midnight Eastern Time, including the seasonal change between EST and EDT. Off-server backup storage uses OVHcloud S3 in Canada. Normal backup retention is three months from backup creation; client-requested deletion follows the timelines described below.
OVHcloud sends hardware-failure alerts to BSC and handles hardware failures according to its policies.
Backup jobs can be affected by maintenance, incidents, technical constraints or provider disruption. Recovery depends on usable available copies, data volume, incident circumstances and infrastructure. These arrangements do not guarantee successful backups at every interval, a particular uptime, a fixed recovery time or zero data loss.
Security incidents and service communications
OVHcloud notifies BSC of security incidents, and the BSC team becomes involved in assessment and mitigation. Provider notices are one source of incident information; they do not establish detection of every application, account or internal incident.
When issues are noted that may affect end users, BSC sends email notifications to agency administrators and provides periodic status updates.
Our current standard agreement provides for customer notification without undue delay when BSC becomes aware of unauthorized access or a suspected security incident affecting customer data, or sooner where applicable law requires. Notification is not conditional on an OVHcloud notice, insurer consent, completion of a forensic investigation or standard support hours. Applicable law and each customer’s signed agreement govern notification and cooperation duties.
Retention, exports and ending service
Customers retain ownership of their data and can request an export through an authorized representative. Our current standard agreement provides for a supported or mutually agreed format, verification of the recipient and a suitably protected transfer. The data scope, available attachments and any material exclusions are identified before work begins.
Service-exit arrangements include notice and a reasonable opportunity to arrange an export before irreversible deletion of the active dataset.
When a client requests deletion, BSC performs initial soft deletion within 24 hours and permanent hard deletion within 30 days of the request. Soft deletion marks data as deleted without immediately removing the underlying stored copies. Hard deletion removes those stored copies. These timelines cover all of that client’s data, including attachments, backups and temporary or support copies.
The normal three-month backup retention setting does not extend the stated 30-day hard-deletion period for a client deletion request. Applicable legal retention requirements and any lawful legal hold remain relevant. Customers should discuss any special statutory retention or post-contract destruction requirements with BSC before using the service.
Privacy and agency assessments
Our current standard agreement is intended for private for-profit and nonprofit social-service organizations. An agency’s activities and records may require additional privacy, health-information, child-services or other arrangements. This page does not establish universal legal compliance or replace an agency-specific assessment.
BSC can provide information about AIMS hosting, access controls, audit logging, retention and data handling to support an agency’s privacy impact assessment. BSC does not publish a public privacy impact assessment for AIMS.
For requests about personal information in agency records, contact the agency first. For questions about BSC’s handling of information, contact our President through support@bscsolutions.ca. Our Privacy Policy explains personal information handling across our website and services.
Request further documentation or report a concern
Email support@bscsolutions.ca for security questions, privacy concerns or requests for further documentation. Include your organization, the product being assessed, the information requested and any relevant deadline. This contact channel does not establish a staffed 24-hour incident hotline or a guaranteed response time.
Please do not include passwords, credentials or unnecessary personal information in your request. If sensitive evidence is needed, ask BSC to arrange an appropriate secure exchange.
Supporting security material is provided subject to confidentiality, customer-data protection and any third-party disclosure permissions. Detailed architecture, vulnerability information and testing reports are not published here. Active scanning or penetration testing requires separate written authorization and applicable owner/provider permissions.