01
What we never keep
Our benign proof standard limits what a campaign can collect in the first place. We stop the moment a test succeeds, so the most sensitive things never reach us.
- Passwords, MFA codes or session tokens. Our test pages record that someone submitted the form, not what they typed.
- Money. No payment, transfer or banking change ever goes through.
- Your data. We don't open, copy or remove files, customer records or payroll data.
- Photos of people. Any face or name caught by accident is blurred or removed.
If an operator sees sensitive information by accident, they don't copy it, and they tell your trusted agents.
02
What we do keep
A campaign produces evidence, and that evidence is what the report is built on:
- Audio recordings and transcripts of test calls, where your signed scope includes recording. We don't record calls to people in places where the law requires every party's consent. Operators keep written notes of those calls instead.
- If your campaign uses AI voice cloning: recordings of the consenting person's voice and the voice model built from them.
- Timestamps of how staff responded to test emails: opened, clicked, reported or submitted.
- Photos of premises and of the markers we leave.
- Operator activity logs, with times and locations.
- Harmless technical evidence from external testing, such as hostnames and configuration settings.
All of it belongs to one engagement and is used for nothing else. It is never used for marketing. The only AI model ever built from it is a consented voice clone for that one campaign.
03
Storage and access
Engagement data is encrypted and kept apart from every other client's.
Only the people working on your engagement can open it. On your side, raw evidence goes only to the trusted agents named in your scope schedule. Reports and evidence are never sent as plain email attachments.
04
Retention and destruction
Raw evidence is kept long enough to answer questions about the report. The report itself stays until you ask us to delete it.
Anything due for destruction is securely destroyed within 30 days, and we confirm that in writing. If you want evidence destroyed sooner, just ask.
05
Campaign infrastructure
Every campaign runs on infrastructure set up for that client alone: its own domains, phone numbers, mailboxes and test pages. Nothing is shared between clients.
When the campaign ends, we shut down the test pages and mailboxes and release the phone numbers. Domains we registered stay parked until they expire, or we transfer them to you on request, so no one else can pick them up and reuse them.
06
If something goes wrong
If a security incident affects your data, we tell your sponsor as soon as we confirm it: what happened, what was affected, and what we are doing about it. Where there is a real risk of significant harm, we also notify the people affected and the Privacy Commissioner of Canada, as the law requires.
If we find signs of a real attack by someone else during a campaign, we pause and tell your trusted agents immediately.
07
For your vendor review
We'll complete your security questionnaire. Our Rules of Engagement, Privacy Policy and Terms are public. Email contact@northgray.ca.
Found a flaw in this site? See our vulnerability disclosure policy.
Start here