1. Introduction
My Waypoint Technologies Inc. takes reasonable steps to protect our systems, accounts, datasets, and customer information. This Security Statement describes our general approach to security across all MyWaypoint products and services.
This statement does not disclose all security controls, configurations, procedures, or safeguards. Specific internal security architecture is not published to avoid creating security risk.
To report a security vulnerability, see our Responsible Disclosure Policy.
2. Infrastructure Security
Most MyWaypoint products are delivered as static HTML websites. Static architecture significantly reduces the attack surface compared to traditional web applications — there is no server-side application generating public content, no database serving public pages, and no user account system on most products.
Products with dynamic infrastructure (such as MyCleanData) use Amazon Web Services (AWS) cloud infrastructure. Contact form submissions for MyWaypointDigital are processed via AWS infrastructure. Data residency commitments vary by product and are described in the applicable product addendum and in our Vendor and Subprocessor Disclosure.
See our Vendor and Subprocessor Disclosure for the complete vendor list.
3. Access Controls
We use access controls intended to limit access to systems and information based on business need. Controls may include:
- User authentication
- Role-based access
- Administrative access restrictions
- Password requirements
- Multi-factor authentication where available
- Account review and removal processes
For products with user accounts (MyCleanData), customers are responsible for keeping passwords confidential, using strong passwords, enabling MFA where available, and restricting access to authorized users.
4. Application Security
We use reasonable secure development practices and evaluate dependencies for known vulnerabilities.
For products that support API access, customers are solely responsible for the issuance, distribution, storage, management, rotation, and revocation of API credentials assigned to their accounts unless otherwise specified in a written agreement. Customers must maintain appropriate security controls to protect API credentials from unauthorized access, disclosure, or misuse.
Security testing, penetration testing, vulnerability scanning, or load testing against our systems requires prior written permission. See our Responsible Disclosure Policy for the appropriate process.
5. Data Security
We may use encryption or secure transmission technologies to help protect information in transit and, where appropriate, at rest.
All data transmission uses HTTPS. Contact form submissions are transmitted over encrypted connections.
Payment card details for MyCleanData are processed by Stripe. Card details go directly to Stripe — not to MyCleanData servers. We do not store full payment card numbers.
6. Monitoring and Incident Response
We may monitor logs and usage activity to protect against unauthorized access, detect suspicious activity, investigate incidents, enforce usage limits, and maintain platform integrity.
If we become aware of a security incident affecting personal information or customer data, we will investigate and take steps we consider appropriate under the circumstances. Where required by law, we will notify affected parties, regulators, or other required organizations. See our Security Incident & Breach Notification statement for further detail.
No system is completely secure. We cannot guarantee that unauthorized access, data loss, service interruption, or security incidents will never occur.
7. Responsible Disclosure
If you discover a security vulnerability in a MyWaypoint product or service, please report it responsibly.
Contact: security@mywaypoint.ca
See our Responsible Disclosure Policy for the full reporting process, scope, and what to expect after reporting.