Canadian data, stored in Canada.
BotNira is designed to keep Canadian customer and business data within Canadian infrastructure while clearly identifying the limited processing required outside Canada to provide AI-powered communication services.
Where Canadian data is stored and processed.
BotNira separates data residency from the processing required to provide AI-powered voice and communication services.
Data Storage
Canadian vendor and customer data handled by BotNira is stored within Canada.
AI Processing
AI processing required for BotNira's voice and conversational services is performed through OpenAI infrastructure.
Communication Transport
Twilio provides telecommunications infrastructure that transports voice communications between customers and BotNira.
How a Canadian customer interaction works.
The following represents the high-level architecture used when a Canadian customer communicates with a BotNira-powered business.
Customer
A customer calls a BotNira-enabled Canadian business.
Twilio
Twilio provides the telecommunications layer that transports the voice communication.
BotNira
BotNira receives and manages the interaction according to the customer's configuration.
OpenAI
Required speech and conversational AI processing is performed through OpenAI services.
BotNira
The resulting AI response is returned to BotNira for service delivery.
Canadian Storage
Data retained by BotNira for Canadian customers is stored within Canada.
Every BotNira channel has a clear data path.
BotNira supports multiple communication channels. Each channel has its own transport layer, while BotNira manages the application, AI and storage layers.
Phone Calls
Twilio provides the telecommunications layer that carries the customer's voice communication. BotNira manages the application and conversation layer, while OpenAI performs the required AI processing.
WhatsApp provides the messaging transport layer. Once the message reaches BotNira, BotNira manages the conversation and may send required content to OpenAI for AI processing. Data retained by BotNira for Canadian customers is stored in Canada.
Email communications are received and managed directly through BotNira's platform. Where an AI-generated response or AI analysis is required, the relevant content may be processed through OpenAI.
Website Chat
Website chat connects directly to BotNira's platform without a separate messaging provider. Where AI processing is required, BotNira may send the relevant content to OpenAI.
SMS
SMS communications use the applicable telecommunications provider to transport messages to and from BotNira. BotNira manages the application layer and Canadian storage.
Canadian data stays in Canada.
BotNira is designed so that data belonging to Canadian businesses and their customers is stored within Canada when retained by BotNira.
This includes information associated with the customer's BotNira account, business configuration, customer records and other data retained by the BotNira platform.
Canadian customers therefore have a clear separation between their data residency and the external processing services required to operate AI-powered conversations.
Why AI processing occurs outside Canada.
BotNira uses OpenAI services to provide the AI processing required for conversational interactions.
This processing occurs in the United States. As a result, certain information required to generate an AI response may temporarily leave Canada's storage boundary during processing.
This is an important distinction: the location of AI processing does not change the location where BotNira stores the customer's retained data.
OpenAI states that inputs and outputs from its business/API products are not used to train its models by default. OpenAI also provides additional data-retention controls for eligible API customers.
Twilio connects the customer to BotNira.
Twilio provides the telecommunications infrastructure used by BotNira for phone numbers and voice communications.
Connects a customer's telephone call with BotNira's communication infrastructure.
Data retained by BotNira for Canadian customers is stored in Canada.
Twilio's own infrastructure and subprocessors may involve processing outside Canada.
Twilio publishes information about its subprocessors and processing locations. Customers should review the applicable Twilio terms and data processing documentation for the specific services enabled.
WhatsApp conversations follow a separate communication path.
When a customer communicates with a BotNira business through WhatsApp, Meta's WhatsApp infrastructure is involved in delivering the communication.
WhatsApp messages are protected by end-to-end encryption in accordance with WhatsApp's architecture and policies.
After the communication reaches BotNira, information required to provide the service is handled by BotNira and, where required, processed through OpenAI for AI responses.
Designed around Canadian privacy requirements.
BotNira's Canadian data-handling approach is designed to support organizations that have obligations under applicable Canadian privacy legislation.
PIPEDA
The Personal Information Protection and Electronic Documents Act establishes federal privacy requirements for private-sector commercial activities in applicable circumstances.
Applicable frameworkQuebec Privacy Requirements
Organizations operating in Quebec may have additional obligations under Quebec's private sector privacy legislation.
Province-specificProvincial Privacy Laws
Depending on the organization and province, substantially similar provincial privacy laws may apply instead of or alongside federal requirements.
Organization-dependentThis page describes BotNira's technical and data handling approach and is not legal advice. Whether a particular privacy law applies depends on the customer's organization, activities, province, industry, data and other circumstances.
Security controls across the BotNira platform.
BotNira uses technical, organizational and operational safeguards designed to protect customer and business information throughout its lifecycle.
SSL / TLS
Communications with BotNira services are protected using secure transport encryption.
Encryption at Rest
Stored information is protected using encryption mechanisms appropriate to the underlying systems.
Encryption in Transit
Data moving between supported services and systems is protected during transmission.
Two-Factor Authentication
Two-factor authentication provides an additional layer of protection for supported accounts.
Firewall Protection
Network security controls help protect BotNira infrastructure from unauthorized traffic.
DDoS Protection
Infrastructure-level protections help mitigate distributed denial-of-service attacks.
Regular Backups
Regular backups support service resilience and operational recovery.
Vulnerability Scanning
BotNira performs regular vulnerability scanning to identify potential security weaknesses.
Penetration Testing
Penetration testing has been performed to assess the security of the BotNira environment.
Restricted Team Access
BotNira customer data is not accessible to members of the development or operational team as part of routine operations.
Security Response
A dedicated security team is responsible for responding to security incidents and potential security events.
Data Deletion
Following account closure, applicable customer data is retained for 45 days and then permanently deleted.
You control your customer data.
While a vendor actively uses BotNira, data is retained according to the vendor's account, configuration and applicable data-management requirements.
Vendors can manage and delete their customer data, including applicable call and message information, according to the controls available within the BotNira platform.
When a vendor closes their BotNira account, BotNira retains the associated data for a 45-day transition period. After this period, the applicable data is permanently deleted.
Vendor continues using BotNira.
Vendor stops using the BotNira service.
Data remains available during the account closure transition period.
Applicable customer data is permanently deleted.
Independent security and compliance evidence.
BotNira maintains security, privacy and compliance certifications and assessments that help customers evaluate our platform during security and procurement reviews.
SOC 2 Type II
Independent assessment of applicable controls relating to security and trust services.
View certificate →ISO/IEC 27001
Information security management certification for BotNira.
View certificate →ISO/IEC 27701
Privacy information management certification for BotNira.
View certificate →GDPR Compliance
Documentation supporting BotNira's GDPR compliance posture.
View documentation →HIPAA Compliance
Compliance documentation supporting healthcare-related security requirements.
View documentation →Penetration Testing
Security testing performed to identify vulnerabilities in the BotNira environment.
View assessment →Common questions about Canadian data.
Is Canadian customer data stored in Canada?
Yes. Data retained by BotNira for Canadian customers is stored within Canada. However, certain information may be processed outside Canada when required by third-party services such as AI processing or telecommunications.
Does BotNira process Canadian data in the United States?
Yes. BotNira uses OpenAI for AI processing required to provide conversational services. This processing occurs in the United States.
Does PIPEDA prohibit Canadian data from being processed outside Canada?
No. The Office of the Privacy Commissioner of Canada states that PIPEDA does not prohibit organizations from transferring personal information to an organization outside Canada for processing. Organizations remain accountable for protecting the information and must provide an appropriate level of protection.
Is data sent to OpenAI used to train its models?
OpenAI states that business/API inputs and outputs are not used to train or improve its models by default unless the organization explicitly opts in to data sharing.
Does Twilio store or process communication data?
Twilio provides the telecommunications infrastructure used by BotNira. Its services and associated infrastructure may involve processing locations outside Canada. Twilio publishes information about its subprocessors and processing locations.
Can I review BotNira's security certifications?
Yes. BotNira's available security certifications, attestations and compliance documentation are available through the BotNira Trust Center.
Need more information for your privacy review?
Security and compliance teams can review BotNira's documentation or contact us for additional information.