Buchwald Services Consulting Inc. (BSC) provides software and related services for social-service organizations. This page explains our Canadian hosting, data responsibilities and AIMS safeguards, and how to request further information.
Products and scope
AIMS is the base product. TIMMS, PoliScribe Assurance, Job Tracker and Document Management System (DMS) are separately purchased add-ons. Features, deployment arrangements and security controls can differ by product. The specific controls described below apply to AIMS; please request information for the product and deployment your organization is assessing.
Canadian hosting
All BSC data is hosted and stored in Canada. AIMS uses dedicated OVHcloud infrastructure in Beauharnois, Québec. AIMS backups are also stored in Canada.
Your data and our responsibilities
The subscribing agency owns its AIMS customer data, including any personal health information it enters. BSC operates and administers the AIMS environment, including application administration, hosting operations, backups, maintenance and support. OVHcloud provides the infrastructure hosting.
Our current standard agreement limits handling of agency records to the purchased services, lawful customer instructions and legal requirements. It requires reasonable administrative, technical and physical safeguards and restricts access to personnel and authorized subcontractors who need it for those purposes and are bound by protective confidentiality obligations. It gives BSC no independent right to sell, market with or otherwise repurpose agency records. Each customer’s signed agreement governs its services.
Agencies remain responsible for the lawful collection and use of their records, their record-retention requirements and the access they authorize for their users.
AIMS safeguards and access controls
- AIMS uses HTTPS to encrypt communications between users’ browsers and the servers.
- Linux servers holding AIMS customer data use disk encryption at rest. AIMS database backups are encrypted before upload to backup storage.
- Each agency has a separate AIMS database.
- Agencies can enable and enforce two-factor authentication. An optional Agency PIN provides an additional verification step.
- Basic, Intermediate, Power and Administrator access levels are managed by the agency’s AIMS Administrator. Agencies can configure password rules, certain module permissions and automatic logout after inactivity.
- AIMS audit logs record login, logout, actions performed, timestamps and source IP address, and are accessible to the agency’s AIMS Administrator.
BSC staff may access customer information to troubleshoot or diagnose system issues. The encryption and access measures above describe their stated AIMS scope; they do not establish identical controls for every file, copy or other product. No system can offer absolute security.
Backups and recovery
The BSC team schedules and performs nightly AIMS database backups. Off-server backup storage uses OVHcloud S3 in Canada, with a current retention setting of three months from backup creation.
Backup jobs can be affected by maintenance, incidents, technical constraints or provider disruption. Recovery depends on usable available copies, data volume, incident circumstances and infrastructure. These arrangements do not guarantee successful backups at every interval, a particular uptime, a fixed recovery time or zero data loss.
Security incidents
OVHcloud notifies BSC of security incidents, and the BSC team becomes involved in assessment and mitigation. Provider notices are one source of incident information; they do not establish detection of every application, account or internal incident.
Our current standard agreement provides for customer notification without undue delay when BSC becomes aware of unauthorized access or a suspected security incident affecting customer data, or sooner where applicable law requires. Notification is not conditional on an OVHcloud notice, insurer consent, completion of a forensic investigation or standard support hours. Applicable law and each customer’s signed agreement govern notification and cooperation duties.
Retention, exports and ending service
Customers retain ownership of their data and can request an export through an authorized representative. Our current standard agreement provides for a supported or mutually agreed format, verification of the recipient and a suitably protected transfer. The data scope, available attachments and any material exclusions are identified before work begins.
Service-exit arrangements include notice and a reasonable opportunity to arrange an export before irreversible deletion of the active dataset. Retention and deletion depend on the applicable agreement, legal requirements and any lawful retention purpose. Backup and residual copies require separate handling; deletion is not necessarily immediate or simultaneous across every copy.
The normal three-month backup retention setting does not override a mandatory destruction requirement. Customers should discuss any special post-contract handling requirements with BSC before using the service.
Privacy and agency assessments
Our current standard agreement is intended for private for-profit and nonprofit social-service organizations. An agency’s activities and records may require additional privacy, health-information, child-services or other arrangements. This page does not establish universal legal compliance or replace an agency-specific assessment.
BSC can provide information about AIMS hosting, access controls, audit logging, retention and data handling to support an agency’s privacy impact assessment. BSC does not publish a public privacy impact assessment for AIMS.
For requests about personal information in agency records, contact the agency first. For questions about BSC’s handling of information, contact our President through support@bscsolutions.ca. Our Privacy Policy explains personal information handling across our website and services.
Request further documentation or report a concern
Email support@bscsolutions.ca for security questions, privacy concerns or requests for further documentation. Include your organization, the product being assessed, the information requested and any relevant deadline. This contact channel does not establish a staffed 24-hour incident hotline or a guaranteed response time.
Please do not include passwords, credentials or unnecessary personal information in your request. If sensitive evidence is needed, ask BSC to arrange an appropriate secure exchange.
Supporting security material is provided subject to confidentiality, customer-data protection and any third-party disclosure permissions. Detailed architecture, vulnerability information and testing reports are not published here. Active scanning or penetration testing requires separate written authorization and applicable owner/provider permissions.