Your clients’ data is protected at every layer.
PlanBase is built for Canadian financial professionals who are accountable for their clients’ most sensitive information. That responsibility runs from the infrastructure to how Finn handles a single document.
- Canadian data residency
- TLS 1.2+ and AES-256
- PCI DSS via Stripe
- PIPEDA & Québec Law 25
Built to protect sensitive financial data.
Encryption in transit and at rest
All data transmitted between your browser and PlanBase is encrypted using TLS 1.2+ with 256-bit ciphers. Data at rest is encrypted using AES-256. No data leaves our systems unencrypted.
Canadian data residency
Your client data never leaves Canada. All customer data, including financial plans, client records, Finn threads and account information, is stored exclusively on servers located in Canada.
PCI DSS payments
Payment processing is handled entirely by Stripe, Inc., a PCI DSS Level 1 certified provider. PlanBase never stores, processes, or transmits full credit card numbers or CVV codes.
Access controls
Access to production systems is restricted to authorized PlanBase personnel on a need-to-know basis. All administrative access is logged, monitored, and subject to multi-factor authentication.
PIPEDA & Law 25
PlanBase complies with PIPEDA and Québec’s Law 25 (Bill 64). We maintain a designated Privacy Officer and respond to access requests within statutory timeframes.
Breach notification
In the event of a confirmed data security breach, we notify affected customers without undue delay as required by PIPEDA. Our incident response plan is reviewed annually.
How Finn handles client data.
Finn reads statements, policies and T2 returns to build the plan. Here is what that means for your clients’ information.
Stored in Canada
Documents, plans and Finn’s client threads sit on Canadian servers with the rest of your data.
Never trains AI models
Client data is never used to train AI models and is never sold.
You approve every change
Finn proposes; nothing reaches the plan until you apply it.
Numbers from the engine
Every figure comes from the deterministic PlanBase engine. Finn cites figures; it never invents one.
One reviewable thread per client
Every document, question and decision in one place your team and compliance can review.
What we comply with.
PlanBase is designed for licensed financial advisors and planners who operate under strict regulatory requirements. Our compliance posture reflects the standards expected of financial services in Canada.
- Data residency
- Canada onlyAll data stored on Canadian-based servers
- Encryption in transit
- TLS 1.2+ / 256-bitEnforced on all endpoints
- Encryption at rest
- AES-256Applied to all stored data
- Payment processing
- PCI DSS Level 1Via Stripe. No card data touches our servers.
- Privacy legislation
- PIPEDA + Law 25Federal and Québec compliance
- Anti-spam
- CASL compliantExpress/implied consent model enforced
- MFA for admin access
- RequiredAll internal system access gated by MFA
- Incident response plan
- Annual reviewDocumented and tested yearly
Built for regulated professionals
PlanBase is software for advisors, not a dealer, adviser, or portfolio manager. We do not provide financial, investment, tax, or legal advice, and neither does Finn. Advisors using PlanBase remain responsible for ensuring their use of the platform complies with obligations imposed by CIRO, the FP Canada Standards Council, and applicable provincial regulators.
Security questions, answered.
All customer data is stored on servers physically located in Canada. We do not transfer customer data outside of Canada without explicit written consent.
Questions about our security practices?
We’re happy to provide additional documentation for your firm’s due diligence process.
Contact the security team