PIPEDA

Overview

PIPEDA is Canada’s federal private-sector privacy law governing how organizations collect, use, and disclose personal information in the course of commercial activities. It is based on fair information principles, including accountability, consent, limiting collection, safeguards, openness, individual access, and challenging compliance. For Xano as a SaaS platform provider, PIPEDA alignment means maintaining privacy, security, contractual, and operational controls designed to support responsible processing of personal information through the Xano platform. For customers that use Xano to build and operate applications, this helps support their own privacy obligations; however, customers remain responsible for determining their purposes for processing, providing appropriate notices, obtaining consent where required, configuring their applications appropriately, and responding to individual privacy requests.

How Xano Aligns With Criteria

Xano maintains a range of policies, procedures, and operational controls to support its alignment and overall security posture. The examples below highlight key elements of our program in relation to PIPEDA requirements, and do not represent a complete list:

• Data Processing Addendum (DPA) - available to all paid plans (excluding Free plan), please request a DPA by emailing us at security@xano.com
• Subprocessor list - available here (https://docs.xano.com/legal/xano-subprocessors)
• Privacy Notice - available here (https://docs.xano.com/legal/privacy-notice)
• Privacy & Data Protection Policy
• Access Control Policy
• Incident Response Procedure
• Disaster Recovery Procedure
• Vendor Risk Management Policy
• Data Subject Access, Correction, & Erasure Request Procedure
• Audit Logging Procedure