Privacy policy

Who we are and what this covers

Issaber is operated by 2350516 Alberta Ltd. ("Issaber", "we", "us"), a company incorporated in Alberta, Canada. This policy covers this website (issaber.ca) and the work we do for clients: AWS cost audits, project work and fractional engineering.

We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, where it applies, Alberta's Personal Information Protection Act.

The website

Visiting

This site sets no cookies of its own and uses no analytics or advertising trackers. It is hosted on Amazon Web Services and delivered through Amazon CloudFront, which has to see your IP address and browser details to send you each page.

Booking a call

The contact page loads the booking calendar from Cal.com, so Cal.com sees your IP address and browser details once that page is open. If you book a call, you give Cal.com your name, email address and anything you add to the booking. Cal.com passes those details to us and sends the invitation.

Sending a message

The contact form asks for your name, work email, company, phone number, a rough monthly AWS spend and your message. Only the name, email and message are required. The form sends it to our inbox by email through Amazon Web Services; it is not stored on the website. It is also recorded in our own OpSaber workspace, our business system, where our customer records are hosted in AWS Canada (Central), so we can follow up on your inquiry. Email you send to info@issaber.ca arrives in the same inbox.

Client work and audits

The people we work with

Names, work email addresses, phone numbers and job titles of the people at a client we deal with, plus proposals, contracts, invoices and the correspondence that goes with them.

AWS cost audits

• Read-only access. You create a read-only IAM role in your account from a CloudFormation template we provide. The role is explicitly denied the contents of your data stores, among them S3 objects and listings, database table items, log contents, parameter and secret values, Lambda code and KMS decryption.
• What we collect. Settings and metadata: how your resources are configured, resource identifiers, account structure, and cost and usage figures. Settings stay readable, and some can hold values your team typed in, such as Lambda environment variables or EC2 user data. Our tooling does not collect those, and we recommend keeping secrets in Secrets Manager or Parameter Store rather than in settings.
• Where it goes. The evidence we collect is stored encrypted in Issaber's own AWS account. Findings and reports are kept in our business system, hosted in AWS Canada (Central).
• AI-assisted analysis. We use Anthropic's Claude models on Amazon Bedrock, inside our own AWS account, to help analyze the audit evidence. Bedrock may process it in AWS regions in the United States. Amazon Bedrock does not use the inputs or outputs to train models and does not share them with Anthropic. A person reviews every AI draft before anything reaches you.
• Change access, only by agreement. If we agree in writing to make changes for you, a separate role lets our named engineer do that work. That role can reach your data, carries an agreed end date after which it refuses new sign-ins, and is used only for the agreed changes; staying within that is our commitment to you. You can remove any of our access at any time by deleting the stack.

Project work and fractional engineering

We work inside your AWS accounts with the access you grant, and in the course of that work we may come across data stored there. We use it only for the work you asked for, we copy nothing out that the work does not need, and when the engagement ends you remove our access.

How we use information

• To reply to you and arrange calls.
• To scope, deliver and support the work you engage us for.
• To invoice and keep the business records the law requires.

We do not sell personal information, we do not use it for advertising, and we do not use client data to train AI models.

Who helps us

• Amazon Web Services: hosts this website, the contact form, our business system and our audit tooling. Where: Canada (Central) for our business system; the website is delivered through CloudFront's worldwide network.
• Amazon Bedrock (Anthropic's Claude models): AI-assisted audit analysis, as described above. Where: United States.
• Cal.com: call booking. Where: United States.
• Zoho Mail: our email. Where: Canada.
• Intuit QuickBooks Online: invoicing and accounting. Where: United States.

Each provider gets only what it needs to do its job. Where a provider works outside Canada, mostly in the United States, the information it handles is subject to the laws of that country and can be accessed by its courts and authorities.

How long we keep it

• Enquiries: for as long as we need them to reply and to keep a record of our dealings, then deleted.
• Contracts and invoices: as long as Canadian tax law requires, generally six years.
• Audit evidence and findings: for the engagement, and afterwards only as long as we need them to support the work we delivered. Ask us and we will delete them sooner, unless the law requires us to keep them.

How we protect it

We hold our own systems to what we recommend to clients: encryption in transit and at rest, and access limited to what each piece of work needs. If a breach of security creates a real risk of significant harm to anyone, we will tell the people affected and report it to the Privacy Commissioner, as the law requires.

Your choices and rights

You can ask us to tell you what personal information we hold about you and give you a copy, to correct anything that is wrong, to stop using information you consented to, or to delete what we no longer need. Some records, such as invoices, the law requires us to keep. We answer within 30 days.

If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada or, in Alberta, the Office of the Information and Privacy Commissioner of Alberta.

If you are in the European Union or the United Kingdom, we handle your business contact details to reply to you, to perform our contract with your organization, and for our legitimate interest in running our business. You also have the rights to restrict or object to our use of your information, to receive it in a portable form, and to complain to your local data protection authority.

Changes to this policy

When this policy changes, we update the date at the top. If a change affects current clients significantly, we tell them before it takes effect.

Contact

Our Privacy Officer is accountable for how we handle personal information. Write to info@issaber.ca with "Privacy" in the subject, or use the contact form. We reply within one business day.

2350516 Alberta Ltd., operating Issaber. Alberta, Canada.