Software built for Toronto companies, with your data and code staying where you agreed
We build and run software for companies that want the ownership, residency and support answers written down before a contract, not discovered during one. Nobody here is in Toronto.
- When we are actually at our desks
10:00 to 19:00 IST, which is 04:30 to 13:30 UTC, all yearNeither figure drifts. In Toronto that is 00:30 to 09:30 while the clocks are forward, and 23:30 to 08:30 once they go back.
- Where your code and your data sit
Your repositories and your cloud accounts, in the region you pickThe accounts are yours, so the region is your setting rather than our promise. Access to them is cross border, which is the separate fact a privacy review asks about.
- Who is in Toronto
NobodyWe deliver from Vadodara, India. No Toronto office and no local staff.
Tell us what you are building
We will reply within one business day with a technical person on the call.
Start with the shape of the work
What is actually holding this up
The answer that has your name on it
Whether Canadian customers' personal information can be handled by people outside Canada is a question you answer in writing, in your own name. It arrives late, from someone with no reason to say yes quickly, and no supplier can sign it for you.
A questionnaire you did not write, on a clock you do not control
One enterprise customer's risk team sends a long spreadsheet mid-deal. Every row about who builds your software becomes your homework, and the deal waits in a queue somewhere inside their organisation.
The ownership clause nobody read
The invoices are paid and the code is in your repository, so you assume it is yours. In Canada the default runs the other way. The moment it matters is the moment you try to sell, raise, or move suppliers.
A handover that was a zip file
The build finishes, the team disperses, and what you hold is source code nobody can explain. Six months later a change that should take a day takes a month, and the reasoning left with people you can no longer reach.
Where the build actually lives, and who reaches it
Feeds in
Your repositories
Every commit and the review that gated it, in your own Git hosting. What crosses is code, never a copy of production data.
Feeds in
Our software engineers
Named accounts reaching your environment from India, created and removed on your instruction. Access, never custody.
The centre
Your cloud account
The one place your production data ever sits. Your account and your bill, so the region is a setting you own.
Serves
Your customers
The running product, served from the region you chose. Amazon publishes ca-central-1 and an opt-in ca-west-1 in Calgary; Microsoft publishes Canada Central in Toronto and Canada East in Quebec.
Serves
Your reviewers
Audit logs, architecture decisions and access records your counsel or your customer can read without asking us.
Acknowledgement targets inside our support hours, by severity
- A P1 is acknowledged by a named person within 4 working hours
- A P2 within 24 working hours
- Everything else within 72 working hours
- Working hours are Monday to Friday, 10:00 to 19:00 IST
- These are acknowledgement targets by a person who engages with the issue, not resolution times. We do not commit to a resolution time, because how long a fix takes depends on what the fault turns out to be.
The twenty-four hour day, in UTC, both halves of the year
Show data table
| Segment | Value (hours) | Share |
|---|---|---|
| Only us, 04:30 to 13:00 UTC | 8.5 | 35.4% |
| Both of us, 13:00 to 13:30 UTC | 0.5 | 2.1% |
| Only Toronto, 13:30 to 21:00 UTC | 7.5 | 31.3% |
| Neither of us, 21:00 to 04:30 UTC | 7.5 | 31.3% |
While the clocks are forward, a Toronto nine o'clock start catches the last half hour of our day. Once they go back it catches none of it at all. That is the real number, and it is why this engagement runs on written artifacts rather than on a daily call. Where a live sync is genuinely needed, a project coordinator can host it or an overlap shift can be arranged on request.
Who owns the code, under Canadian law
The author owns it first, whoever paid
Section 13(1) of the Copyright Act makes the author the first owner of copyright, whoever commissioned or paid for the work. It has always been the operative rule for a commissioned build: the provision repealed at section 13(2) in 2012 covered ordered engravings, photographs and portraits, and never reached software.
The employment rule does not reach a supplier
Section 13(3) gives the employer first ownership only where the author worked under a contract of service. A development firm works under a contract for services, so a commissioned build falls back to 13(1).
Only a written, signed assignment moves it
Section 13(4) says no assignment is valid unless in writing and signed by the owner of the right. Moral rights are separate. Section 14.1(2) allows them to be waived but not assigned, and 14.1(3) says an assignment is not by itself a waiver. Require both clauses from anyone bidding, ours included.
An NDA does not do this job
An NDA restricts disclosure and use. It grants no right to modify, relicense, resell or move a codebase. A supplier can keep your confidence perfectly and still hold first ownership of your product.
What we already put on the record
From day one every line of code is your IP, in your repositories and your accounts. This is the general position under Canadian law rather than legal advice, and your counsel should confirm it against your own facts.
A security review, split by who can actually answer it
The Cloud Security Alliance's Cloud Controls Matrix v4 is a control framework setting out 197 control objectives across 17 domains, one of them Supply Chain Management, Transparency and Accountability. The Shared Assessments questionnaire calls the same thing Nth party management.
| Domain in the questionnaire | What we answer in writing | What only you can answer |
|---|---|---|
| Access control | What we answer in writingWho holds an account in your environment, and how it is created and removed. | What only you can answerWhether your customer's terms permit that access at all. |
| Application security and change control | What we answer in writingCode review by a senior software engineer behind a CI gate. GitFlow, unit and integration tests on every merge. | What only you can answerYour release approval, and who signs before production. |
| Nth party and supply chain | What we answer in writingThe architecture decisions are documented in the TRS and that document is yours, so a reviewer reads a file rather than taking an assurance. | What only you can answerDisclosing us to your customer, on your contract's timetable. |
| Data security and privacy | What we answer in writingWhere the systems sit and exactly who reaches them from India. | What only you can answerClassification, retention, and whether the transfer is lawful for your data. |
| Audit and assurance | What we answer in writingWe hold no SOC 2, GDPR or HIPAA certification ourselves. We engineer systems that pass your audits. | What only you can answerWhether a certificate on the supplier is required, or whether the evidence is. |
Where the privacy exposure lands
Choosing a supplier with good answers feels like handing them the privacy problem. It is not. The Office of the Privacy Commissioner of Canada put it plainly in its 2009 cross-border guidelines. PIPEDA does not distinguish between domestic and international transfers. Sending personal information to a processor abroad is a use of it, and you stay accountable.
What we commit to
We document architectural decisions in the TRS, and that document is yours to keep. The evidence you need is a file rather than a phone call.
The same guidelines allow a contract to require comparable protection from a processor. What no contract reaches is the law of the jurisdiction that processor sits in. Customers must also be told their information may be processed abroad, and reached there by courts and authorities. An in-country region is therefore half an answer.
What we commit to
Your code and deployments sit in your accounts, in the region you choose, reached by named accounts held by software engineers in India. That is the access picture your counsel is asking for.
An arrangement of this shape has been examined. In PIPEDA Findings #2020-001, issued 4 August 2020, the Commissioner looked at a Canadian bank that outsourced fraud claims processing to a provider with employees in India, and found the matter not well-founded, which in that office's vocabulary means no contravention. What satisfied the accountability limb was independent audits of the provider, remediation sign-off and an annual attestation.
What we commit to
That finding named no processor and cleared no supplier, ours included. It gives you the bar rather than the outcome. General position under Canadian law, not legal advice.
What you end up holding
01
Requirements and design
Discovery first, then the BRD, FRD, SRS and TRS at the depth the work needs.
You get
A technical requirements document carrying the architectural decisions and the reasons for them, so a reviewer can check design intent without interviewing anyone.
02
Every change to the plan
Scope is agreed before work starts, and a change is written down before it is accepted.
You get
A documented change note setting out time, effort and cost before approval. Nothing in the build moves on a re-scope you have not accepted.
03
Every change to the code
Work reaches your branch through a review, on your own hosting.
You get
Code review by a senior software engineer behind a CI gate, so a second person has read every line. The history sits in your repository.
04
Running it
After launch, either an Annual Maintenance Contract or a lighter lean-mode arrangement.
You get
Both run through the same change-note process as the build, so the discipline does not lapse the week the project is called finished.
05
Us leaving
Every engagement ends, and the question is what survives it.
You get
You keep everything, including the operational runbook. The decisions are in the TRS and every change was read by a second software engineer. The knowledge was never in one person's head.
Tell us what you are building
Build it with us, or hire your own team
Several of our longest enterprise relationships began as one scoped project and extended once the first delivery had been checked.
You want the outcome, not the headcount
Choose this when
Something has to exist by a date, and you would rather hold a scope and a change-note process than a set of people.
It costs you
You are buying a scope rather than a team, so widening it is a change note rather than a conversation.
You want people inside your own process
Choose this when
You already have a team, a board and a standup, and what is missing is capacity in a named stack.
It costs you
The planning, the standups and the prioritisation stay yours, so the capacity only helps if you have the bandwidth to direct it.
Whether to call us
Where we fit
You are building something new, or taking over software that already ships, and want the decisions written down as they are made.
Your customers send security questionnaires and you would rather answer from a file than from memory.
You hold Ontario personal health information. The Information and Privacy Commissioner of Ontario states PHIPA does not require it to be retained and stored in Ontario or Canada. The condition is accountability plus appropriate safeguards, and it sits on you as custodian.
Your Quebec customers are in scope. Section 17 of the Quebec private-sector Act, CQLR c. P-39.1, requires a privacy impact assessment before personal information goes outside Quebec, under a written agreement. The communication may proceed only if that assessment concludes the information would receive adequate protection. That is an obligation on you rather than a prohibition, and the access picture above is what the assessment needs.
Someone has quoted the federal data residency direction at you. It sets Canadian residency requirements for federal data at Protected B and above. Unless you are delivering to a federal department at those levels, it does not bind your company. It is worth knowing which situation you are in.
Everything above describes the general position under Canadian law rather than legal advice, and your own counsel should confirm it against your own facts.
Where we are the wrong call
You need the software engineers live in a Toronto business day as the norm rather than as an arranged exception. Our day ends before yours starts once the clocks go back.
Your own contract bars foreign access to the data rather than letting you choose the region. A Canadian region does not solve that and neither do we.
A certification logo on the supplier itself is a hard requirement. We do not hold SOC 2, GDPR or HIPAA certifications.
Questions we get asked before a first call
Does our data have to stay in Canada, and can it?
- The Office of the Privacy Commissioner of Canada set this out in its guidelines for processing personal data across borders, published 27 January 2009. PIPEDA does not distinguish between domestic and international transfers of data.
- If you want your data in Canada anyway, that is a setting in your own cloud account rather than a promise from us.
- Amazon Web Services publishes ca-central-1 as enabled by default. It publishes ca-west-1 in Calgary as an opt-in region, off until you turn it on.
- Microsoft publishes Canada Central in Toronto and Canada East in Quebec, and notes that only Canada Central carries availability-zone support.
- What none of that settles is who can reach the data once it is there, which is the separate question in the next answer.
- This describes the general position under Canadian law and is not legal advice for your own facts.
Can our Canadian customers' personal information be processed by people in India?
- The Office of the Privacy Commissioner's 2009 cross-border guidelines set out what has to be showable. The first is comparable protection through contractual or other means.
- The second is that customers have been told their information may be sent to another jurisdiction, and may be accessed there by the courts, law enforcement and national security authorities.
- The same guidelines are blunt about the limit. What an organisation cannot do through contract, or indeed by any other means, is override the laws of a foreign jurisdiction.
- An arrangement of this shape has been examined. In PIPEDA Findings #2020-001, issued 4 August 2020, the Commissioner looked at a Canadian bank that had outsourced fraud claims processing to a provider with employees in India. It concluded the matter was not well-founded. In that office's vocabulary, that means no contravention.
- Independent audits of the provider, remediation sign-off and an annual attestation are what satisfied the accountability limb.
- That finding named no processor and cleared no supplier, including us. We do not hold SOC 2, GDPR or HIPAA certifications ourselves.
- General position under Canadian law, not legal advice.
Who owns the source code, and when does it transfer?
- If you already have Git hosting, cloud accounts and storage, we work inside them. If you do not, we provision them, set them up and hand the keys over, so the accounts are yours either way.
- Any documentation we produce is yours to keep, and if you offboard us you keep everything including the operational runbook.
- The Canadian default is worth knowing regardless, because it applies to everyone you might hire. Section 13(1) of the Copyright Act makes the author the first owner, and it has always been the operative rule for a commissioned build.
- Section 13(4) says no assignment is valid unless it is in writing and signed by the owner of the right.
- Moral rights are separate and cannot be assigned, only waived. Require both clause types from anyone bidding for this work.
- General position under Canadian law, not legal advice; your counsel should confirm it against your own facts.
What hours can we actually reach you, and what happens when something breaks?
- In Toronto that lands at 00:30 to 09:30 while the clocks are forward, and 23:30 to 08:30 once they go back. So a Toronto nine o'clock start catches the last half hour of our day in the summer and none of it in the winter. Most of our working day sits on your night.
- For support, the hours are Monday to Friday 10:00 to 19:00 IST. Within them the acknowledgement targets are four working hours for a P1, twenty-four for a P2 and seventy-two for everything else.
- That target is acknowledgement by a named person who engages with the issue, not resolution. How long a fix takes depends on what the fault turns out to be.
- Where a live standup or sync is needed, a project coordinator can host it, or an overlap shift can be arranged on request.
- Every software engineer works from India and there is nobody in Toronto.
How do we stop the scope moving underneath us?
- Nothing in the build moves on a re-scope you have not explicitly accepted. That holds during the build, and afterwards on an Annual Maintenance Contract or a lean-mode arrangement.
- The order of work is discovery first, then the BRD, FRD, SRS and TRS at the depth the project needs. Then milestone planning, then execution.
- Delivery is measured against the agreed scope, and the first delivery is the honest referendum on whether the engagement is a fit at all.
- If it is not, you have the requirement documents, the repository and the runbook, and you are not stranded.
Still deciding whether we fit?
Tell us what you are building
Send the shape of the work. What it does, who it is for, where the data has to sit, and the date you have already promised. We will reply within one business day with a technical person on the call.
If your engagement needs a certified vendor we tell you upfront and refer where appropriate. We have declined work that suited us and not the project.
- Everything you send stays between us.
- A technical person on the first call.
- A clear no, with a direction, if we are the wrong supplier.