FAQs

The following is a public summary of our response to a potential data breach.

If you suspect there has been a data security breach, please contact us via our Contact Us form on our web site to intiate an investigation.

SUMMARY

In the event of a suspect data breach, we will notify affected customers. This notification will include the following information, where available:

• Extent of the data breach
• Type and volume of personal data involved
• Cause or suspected cause of the breach
• Whether the breach has been rectified
• Measures and processes that we implemented at the time of the breach
• Information on whether affected individuals of the data breach were notified and if not
• Contact details at Hosted in Canada Surveys with whom your organization can liaise for further information or clarification

Where specific information of the data breach is not yet available, we will send an interim notification comprising a brief description of the incident.

DATA BREACH MANAGEMENT PLAN

Upon being notified of a (suspected or confirmed) data breach either by a customer or via our automated systems, we activate our data breach & response plan.
Our data breach management and response plan is:

1. Confirm the Breach
2. Contain the Breach
3. Assess Risks and Impact
4. Report the Incident
5. Evaluate the Response & Recovery to Prevent Future Breaches

CONFIRM THE BREACH

Immediately upon suspicion or a report of a data breach, we will confirm that the data breach has occurred. At this point, we may proceed to Contain the Breach on the basis of an unconfirmed reported data breach, depending on the likelihood of the severity of risk.

CONTAIN THE BREACH

We consider the following measures to Contain the Breach, where applicable:

• Shut down the compromised system that led to the data breach.
• Establish whether steps can be taken to recover lost data and limit any damage caused by the breach.
• Prevent further unauthorized access to the system.
• Reset passwords and public/private keys if accounts and / or passwords have been compromised.
• Isolate the causes of the data breach, and where applicable, change the access rights to the compromised system and remove external connections to the system.

ASSESS RISKS AND IMPACT

Knowing the risks and impact of data breaches helps us determine whether there could be serious consequences to affected individuals, as well as the steps necessary to notify the individuals affected.

Risk and Impact on Customers

• How many custtomers were affected?
  A higher number may not mean a higher risk, but assessing this helps overall risk assessment.
• Whose personal data had been breached?
  Iddentify which accounts have been affected, and what data has been compromised.
• What types of personal data were involved?
  This will help to ascertain if there are risk to reputation, identity theft, safety and/or financial loss of affected individuals.
• Any additional measures in place to minimize the impact of a data breach? eg: a lost device protected by a strong password or encryption could reduce the impact of a data breach.

Risk and Impact on organizations

• What caused the data breach?
  Determining how the breach occurred (through theft, accident, unauthorized access, etc.) will help identify immediate steps to take to contain the breach and restore service.
• When and how often did the breach occur?
Examining this will help us better understand the nature of the breach (e.g. malicious or accidental).
• Who might gain access to the compromised personal data?
  This will ascertain how the compromised data could be used. In particular, affected customers must be notified if personal data is acquired by an unauthorized person.

REPORT THE INCIDENT

We will notify affected customers if their data has been breached. This encourages individuals to take preventive measures to reduce the impact of the data breach.

Who to Notify:

• Notify customers whose personal data have been compromised.
• Notify other third parties such as banks, credit card companies or the police, where relevant.
• The relevant authorities (eg: police) should be notified if criminal activity is suspected and evidence for investigation should be preserved (eg: hacking, theft or unauthorized system access by an employee.)

When to Notify:

• Notify affected customers within 24 hours if a data breach involves sensitive personal data. This allows them to take necessary actions early to avoid potential abuse of the compromised data.
• Notify affected customers when the data breach is resolved

How to Notify:

• Use the most effective ways to reach out to affected individuals, taking into consideration the urgency of the situation and number of individuals affected (e.g. media releases, social media, mobile messaging, SMS, e-mails, telephone calls).
• Notifications will be simple to understand, specific, and provide clear instructions on what customers can do to protect themselves.

What to Notify:

• How and when the data breach occurred, and the types of personal data involved in the data breach.
• What we have done or will be doing in response to the risks brought about by the data breach.
• Specific facts on the data breach where applicable, and actions individuals can take to prevent that data from being misused or abused.
• Contact details and how affected individuals can reach the organization for further information or assistance (e.g. support phone numbers, e-mail addresses or website).

EVALUATE THE RESPONSE & RECOVERY TO PREVENT FUTURE BREACHES

After steps have been taken to resolve the data breach, we will review the cause of the breach and evaluate if existing protection and prevention measures and processes are sufficient to prevent similar breaches from occurring, and where applicable put a stop to practices which led to the data breach.

Operational and Policy Related Issues:

• Were there issues with our regular audits of both physical and IT-related security measures?
• Are there processes that can be streamlined or introduced to limit the damage if future breaches happen or to prevent a relapse?
• Were there weaknesses in existing security measures such as the use of outdated software and protection measures, or weaknesses in the use of portable storage devices, networking, or connectivity to the Internet?
• Were the methods for accessing and transmitting personal data sufficiently secure, eg: access limited to authorized personnel only?
• Should support services from external parties be enhanced, such as vendors and partners, to better protect personal data?
• Were the responsibilities of vendors and partners clearly defined in relation to the handling of personal data?
• Is there a need to develop new data-breach scenarios?

Resource Related Issues:

• Were sufficient resources allocated to manage the data breach?
• Should external resources be engaged to better manage such incidents?
• Were key personnel given sufficient resources to manage the incident?

Employee Related Issues:

• Were employees aware of security related issues?
• Was training provided on personal data protection matters and incident management skills?
• Were employees informed of the data breach and the learning points from the incident?

Management Related Issues:

• How was management involved in the management of the data breach?
•  Was there a clear line of responsibility and communication during the management of the data breach?

Data Breach Report Form

Cookies

Cookies are required when using Hosted in Canada Surveys. We use cookies to identify unique visitors, provider per-user customization, and maintain user state between page changes. We don’t share our cookies, nor do we use cookies to track your behavior on other sites.

We reserve the right to contact you, regarding your account or any other matter regarding your use of Hosted in Canada Surveys. With your authorization, we may use some information collected from you to help diagnose technical problems, and improve the quality and types of services delivered. We may use and share non-identifiable aggregated usage and statistical information. We may also share information with third parties in limited circumstances including when complying with legal processes, preventing fraud or imminent harm, ensuring security of network and services and due to violation of the terms of service.

Service-related Announcements

We will send you strictly service-related announcements when it is necessary to do so. For instance, if our service is temporarily suspended for maintenance, we might send you an email. Service-related emails are also sent confirming billing transactions, account upgrades, and account cancellations.

Generally, you may not opt-out of these communications, which are not promotional in nature. If you do not wish to receive them, you have the option to cancel your account.

Based upon the personally identifiable information you provide us, we will send you a welcoming email to verify your username and password as well an account manager contact information. We will also communicate with you in response to your inquiries, to provide the services you request, and to manage your account.

Choice/Opt-out

If you no longer wish to receive our product updates, you may opt-out of receiving them by following the instructions included in each product update email.

We use clear gifs in our HTML-based emails to let us know which emails have been opened by recipients. This allows us to gauge the effectiveness of certain communications and the effectiveness of our marketing campaigns.

Security

Our servers are protected with generally available security technologies, including firewalls and data encryption. Our servers are located in a PCI-DCSS compliant, secure data centre in Montreal, Quebec. The PCI-DCSS security standard was created by the Security Standards Council. These technologies are designed to prevent unauthorized access, but due to the nature of the Internet, no guarantee can be made that your information and data will be secure from intrusions and unauthorized released to third parties.

These policies are effective as of March 01, 2018.

Hosted in Canada Surveys reserves the right to change this policy at any time by notifying its users of the existence of a new policy. The policies outlined in this document are not intended to and do not create any contractual or other legal rights in or on behalf of any party.

We take our users’ security and privacy concerns seriously. We strive to ensure that user data is kept securely, and that we collect only as much personal data as is required to provide our services to users in an efficient and effective manner. We use some of the most advanced technology for Internet security that is commercially available today. This Security Statement is aimed at being transparent about our security infrastructure and practices, to help reassure you that your data is appropriately protected.

PCI-DSS is security standard created by the Security Standards Council that includes requirements for security management, policies, procedures, network architecture, software design and other critical protective measures. The data centre and servers where Hosted in Canada Surveys is located adheres to these standards.

Every Hosted in Canada Survey account is stored on a separate subdomain, and has its own version of both the survey software and the survey database. Your data is never accessible by any other account holder.

Accounts are stored on a shared server; however, each account is a separate web space accessible only to you.

We offer Virtual Private Servers and Dedicated Servers if you have this requirement. This is a "customized" solution, and certainly can be accommodated -- our OneRate pricing does not apply to this arrangement, so please contact us for a personalized quote.

Our Enterprise Prime package includes 256-bit AES at rest data encrption at the database layer, for those organizations who need to meet PHIPA or other Health Record Act privacy requirements. With the combination of SSL and at rest data encryption, you can be assured of the complete encrpytion of all data from end to end browser to server, and server level database.

If you wish to have SSL (secured connection) to your survey -- either for respondents or for administration -- we can accommodate this with SSL certificates (the same implementation used by banks, e-commerce sites, etc).

Our system administrator does have access to the data for the purposes of providing technical support in the event it is required. Our server admin has government-grade security clearance.

No other individuals or organizations have access to your survey data.

When you cancel any survey we are hosting, the data is permanently deleted from the Hosted in Canada Surveys server (you may download a backup of the survey for your own archival purposes).

In addition, you can delete responses manually from a survey at any time (individually or in bulk).