+1 888 285 9583
+33 4 12 39 27 40
Trust Center
Security, Law 25 compliance and hosting: our commitments.
io4 is a Microsoft Solutions Partner, compliant with Law 25 and GDPR, and applies enterprise-grade security practices. Here's how.
Microsoft Solutions Partner
Modern Work · Azure Infrastructure · Security · Data & AI
ISO 27001
Information security management system (under audit)
Law 25 and GDPR
Internal compliance and client support
Hosting in Canada and France
Microsoft Canada Central and Canada East regions, or France for our European clients
Our internal practices
Six rules we apply to ourselves.
Strong authentication
MFA required for every access to client environments.
Principle of least privilege
Granular, audited client access, automatically revoked at the end of the mandate.
Encryption at rest and in transit
Client data encrypted at rest and in transit. Centralized secrets vault.
Audit and logging
Every action by an io4 expert on a client environment is logged and auditable.
Regular penetration testing
Our infrastructure and processes are audited by third parties every year.
Vetted subcontractors
All our subcontractors sign confidentiality and Law 25 and GDPR compliance commitments.
Hosting and jurisdiction
Your data hosted in Canada or France.
By default, we host your data in the Microsoft Canada Central and Canada East regions, or France for our European clients. Any other region is subject to a written agreement. io4's internal tools (CRM, projects, communications) use the same Canadian regions. Our subcontractors are vetted and contractually commit to comply with Law 25 and GDPR.
Request our security packageFrequently asked questions
Frequently asked questions about security and compliance.
Another question? Write to us.
Certification is under audit. Our practices are already aligned with the standard; we will display the certification as soon as it is obtained.
Only the people assigned to your engagement, with named accounts, limited to the scope required and revoked at the end. The principle of least privilege also applies to delegated administrative accounts on your tenant.
You are notified immediately, with the established facts. io4 documents the incident in the format Québec's privacy commission expects and gives your officer what they need for their register.
See Law 25 supportYes. Vendor security questionnaires are answered within five business days. For a documentation-based audit, io4 provides the architecture, internal policies and the list of subprocessors with access to data.
Microsoft as the primary host, in the Canadian or French regions depending on the client. The full list of subprocessors with potential access is provided on request, before signature, and kept current during the engagement.
30 minutes to frame what matters.
A direct conversation with one of our experts: free, focused and practical. You leave with a clear, reasoned perspective on your situation.
