Your organization sets the scope
The organization you select, your membership and your role determine which private records you can read or change.
SECURITY & DATA HANDLING
A clear path
for your data.
Understand what Canada Source receives, who can access it, and what to confirm before bringing sensitive business data onto the platform.
Review before activation
The original workbook and parsed review are stored privately before you choose the active organization snapshot.
External AI is optional
Assisted triage is off by default. An owner must enable it, and its inputs are restricted to categories and aggregate counts.
01 / ACCESS
Who can access your organization?
Access follows the signed-in person and the organization selected for the request.
Membership and role
Owners manage their organization and its access. Editors can maintain data; viewers have read access. Application checks and database policies enforce the selected organization’s boundaries.
Verified sessions
Authenticated requests check signed sessions and their current validity. Private files use authenticated storage access and a short-lived, file-specific upload permission.
Authenticator verification
Organization owners and platform administrators require an authenticator. Editors do not have a blanket authenticator requirement. Sensitive account, member-access, AI-permission and billing actions, and server workbook/original exports, require recent authenticator verification.
Different kinds of downloads
Local manual-map and IBP CSV downloads are separate from server workbook exports. They do not carry the same blanket fresh-verification requirement or server-export audit trail.
Transfer and browser caching
The live site uses HTTPS to protect data in transit. Private responses are marked no-store to limit browser and shared caching. This is not end-to-end encryption: platform services receive and process workbook contents. Copies you download are under your control.
Private workspace, separate sharing
Activating a workbook snapshot does not make it public or create a public file link. Marketplace publication follows a separate visibility path and shares selected records with other signed-in marketplace participants.
02 / DATA FLOW
What happens when you upload a workbook?
Tier 2 and above accept XLSX, XLS and CSV workbooks up to 10 MB. Uploading is a server-processing step, followed by your review and an explicit choice of active snapshot.
- 01
Choose the organization
An authorized owner or editor with an active eligible plan selects the organization and submits the workbook over HTTPS.
- 02
Validate and parse
The server checks the file and parses its tables. The whole workbook is received, including hidden worksheets and hidden rows. Formula cells use the results saved in Excel.
- 03
Review privately
The original file and parsed, normalized review are saved in private storage. Review recognized tables, held rows, warnings, mappings and source scope before using the results.
- 04
Activate the snapshot
Publishing selects the reviewed snapshot for the organization’s workspace. It replaces the active snapshot; it does not publish your workbook to the public website.
Prepare the whole file, not just the visible tab
Remove unrelated data, credentials and unnecessary personal fields before uploading. Hidden content is included. Recalculate and save formulas in Excel, and test the process with a redacted workbook first.
IBP CSV uses a different path
An IBP CSV up to 200 KB is read locally into a staged browser draft. Saving the plan sends the resulting planning data to organization account storage for server validation. It does not send the original CSV through the workbook-upload path.
03 / AI & SUPPORT
Limited inputs. Defined support access.
Optional assistance and administrator support have specific controls; ordinary organization members continue to access data according to their roles.
Owner-controlled AI
External assisted triage is disabled unless an organization owner enables it in security settings. Its purpose is to suggest an investigation area; it is not proof of a cause or a financial calculation.
Restricted external inputs
The triage service receives restricted table categories and aggregate table, mapped-field, review and issue counts. The triage route does not send workbook rows, source labels, supplier names or prices. Reduced metadata is not a claim of anonymity.
Scoped administrator support
To open an organization’s operational workspace, platform administrators need authenticator verification and a recorded, organization-specific support session that lasts 30 minutes. Opening the session and making changes require a support reason. This is separate from an organization member’s normal role access.
Private support tickets and CRM
Signed-in customers can follow their own technical tickets and see support replies and progress. Administrator notes, assignments, priorities and CRM records remain private to approved platform administrators. A CRM link does not grant access to your operational workspace. Avoid adding passwords or unrelated personal data to a ticket.
Security records
Security events record workspace access attempts, server exports, writes and access denials. Account and billing changes retain audit records. These records support investigation; they are not a promise of continuous monitoring or a response-time commitment.
Before enabling an external AI processor, confirm its location, retention and training terms. The owner’s permission switch does not establish those agreements.
04 / RETENTION
Stored data and recovery are different questions.
Retention is an authorized operational decision. Keeping a record is not a guarantee that every previous editing state can be restored.
Retained originals and records
No automatic customer-data purge is enabled. Stored originals, normalized snapshots, decision notes and bid records remain pending an authorized retention or deletion decision.
Replacement is not deletion
Changing a plan or replacing the active workbook does not automatically delete previously stored originals or snapshots. Do not use either action as a deletion request.
Request retention or deletion
Work with your organization owner and support to identify the organization and records, confirm the authorized scope, and agree the deletion process. Referenced records, applicable holds, archives and backup-copy handling need to be considered.
05 / BEFORE YOU UPLOAD
Agree the basics with your owner.
Use this checklist for a first workbook or a change in data sensitivity. It is a preparation guide; ticking through it does not certify a dataset.
Open the onboarding guide- 01
Name the owner and the right members
Confirm who maintains data, who only reads it, and which actions require an authenticator.
- 02
Check the organization and source scope
Choose the correct organization, reporting period and currency. Confirm which sheets, rows and business areas the workbook contains.
- 03
Start with a redacted workbook
Remove unrelated data, credentials and unnecessary personal information, including hidden content. Recalculate and save the file before upload.
- 04
Confirm provider and AI terms
Ask about provider locations and retention terms. Keep external AI off unless the owner approves it and the processor’s terms are understood.
- 05
Ask for recovery evidence
Confirm the scope and date of offsite backup and restore verification. Do not assume a recovery commitment from the presence of backup tooling.
- 06
Agree retention and deletion handling
Identify the owner, support contact and authorized request process, including downloaded copies, archives and backups.
06 / CONTACT
Ask about data handlingClarify the details before your first upload.
Contact Canada Source with your organization name and the question you need answered. For retention or deletion, involve your organization owner. Avoid placing confidential workbook content or credentials in the initial message.