How Fathom handles your data.
Fathom handles regulated personal information for plan members in every Canadian province. Here is exactly how we protect it, including what is built today and what is still on the way.
Built today
Tenant isolation
Each brokerage is an isolated tenant. Data access is scoped to your tenant on every path, backed by a fail-fast guard that throws on any unscoped query. Your documents, clients, employee records and named rates are never visible to another brokerage on the platform.
The shared engine
One deliberate exception, and it is narrow. Anonymised rate observations — carrier, region, industry, size, premium, rate movement — pool across the platform, so a new brokerage gets a real benchmark on day one instead of after a year of collecting. Individual records never cross: the crossing is a column allowlist on a single table, enforced by the same guard, and every other model stays sealed. No figure is published from fewer than four comparable observations.
Encryption
TLS in transit. Data is encrypted at rest by our infrastructure providers under their platform defaults. Connected-mailbox credentials are additionally application-encrypted with AES-256-GCM. Per-tenant key isolation, KMS-backed, is on the near-term roadmap.
Tamper-evident audit trail
Every regulated action is recorded to an audit log where each entry is SHA-256 hash-chained to the one before it, per tenant. Any alteration or deletion of history is detectable, and chain verification is built in.
Authentication
Bcrypt password hashing and signed, httpOnly cookie sessions. Logout and password reset revoke live sessions server-side, so a sign-out actually ends access.
Human in the loop
The agent drafts; the licensed broker reviews and authorizes. Carrier submissions, client communications and benefit-change confirmations all require human sign-off. By design and by regulation.
Hardened intake
The public funnel enforces per-IP rate limiting, a file-type allowlist with magic-byte content sniffing, and safe content-type and disposition on every download.
Compliance posture
The part a buyer's security reviewer actually reads.
- Data residency
- The database and application run in Toronto, Canada (DigitalOcean, tor1) — client, employee, review and audit records stay in-country. Uploaded documents (Cloudflare R2 object storage) and model inference (Anthropic, US, no training on your data) are the two things processed outside Canada.
- PIPEDA
- We operate as the data processor under your broker tenant's authority; you are the controller. DPA available on request.
- Breach and incident process
- Standing incident-response runbook. We notify the affected tenant first, then assist with the Privacy Commissioner notice under PIPEDA.
- SOC 2
- Not yet certified. We build to its trust-services criteria — access control, tamper-evident audit, encryption, change management — and will pursue formal certification as we scale. We will not claim a certification we do not hold.
On the roadmap
Field-level encryption of the most sensitive fields (date of birth, claims, salary), Postgres row-level security, Canadian-region data residency, and point-in-time recovery with off-site backups.
Subprocessors
Anthropic for model inference (US, no training on customer data per their commercial terms), our Postgres host (DigitalOcean, Toronto/tor1), Cloudflare R2 object storage, Stripe for billing, and our email provider. Current list available on request.
Questions from a security reviewer are welcome and get answered directly rather than deflected to a portal. james@scotiablue.com