Privacy Policy
Last updated: November 8, 2026
SB Software Inc. ("SB Software", "we") is a cybersecurity company based in Montreal, Quebec. This policy explains what personal information we collect, why, who we share it with, how long we keep it and what rights you have. It follows Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25), Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Canada's Anti-Spam Legislation (CASL).
Person in charge of personal information
Pavel Sushko, Director of IT, is responsible for the protection of personal information at SB Software. Contact: privacy@sbsoftware.ca.
What we collect and why
Contact form
When you write to us through the contact form on this website we collect your first and last name, email address, phone number (if you give it) and your message. We use them only to answer you and follow up on your request.
Security self-check (sat.sbsoftware.ca/check)
When you complete the free security self-check we collect:
- your answers to the 20 questions and the score calculated from them;
- your first and last name, work email, company, role, number of employees, industry, province and, if you give it, your phone number;
- your consent choices, with the date, time, your IP address and the exact wording you agreed to, as the legal record of your consent.
You must agree that we may use your answers to contact you about the assessment. We use them to prepare your result, to contact you about it and to understand your organization's needs.
Receiving security tips and offers by email is optional and off by default. If you tick that box, we send you an email with a confirmation link, and we add you to our mailing list only after you click it. Every marketing email lets you unsubscribe.
Clients
When you are a client, the information we handle during an engagement (for example, assessment results) is also governed by our agreement with your organization.
Website visits
With your permission, our website uses Google Analytics and Google Tag Manager to measure how visitors use it (pages viewed, approximate location, device and browser). These tools set cookies. They are off by default and load only if you click "Accept" in the cookie banner. To change your choice at any time, use Cookie settings at the bottom of every page. Your choice is saved in your browser, not in a cookie.
If you accept, we also use Google Analytics advertising features (Google signals). When you are signed in to a Google account and have turned on Ads Personalization, Google links your visits to that account. This lets Google measure visits across your devices and gives us aggregated reports on visitors' age range, gender and interests. We never see who you are in these reports, and we do not use them to show you ads. To stop Google from linking your activity, turn off Ads Personalization at https://myadcenter.google.com/. You can also see and delete what Google holds in My Activity, or decline cookies in our banner.
Our forms use Cloudflare Turnstile to block automated spam. Turnstile checks your browser and IP address when you submit a form; it is not used for advertising.
Who we share it with
We do not sell or rent personal information. We share it only with service providers that help us run our business, under agreements that require them to protect it:
- Google Workspace: email, and storage of self-check results and client files;
- HubSpot: our customer relationship management system (contact details, self-check score and consent status);
- Cloudflare: website and application hosting, security and spam protection;
- Resend: delivery of the emails sent from our forms;
- Google Analytics: website statistics and, with your permission, the advertising features described above.
Some of these providers store or process information outside Quebec and Canada, including in the United States, where it may be accessible to local authorities under local law. We assess these transfers and use only providers that offer adequate protection.
We do not send your self-check answers to AI services or use them to train AI models.
How long we keep it
- Self-check submissions: 24 months after you submit, unless you become a client. An automated job then deletes the result file and its record.
- Submissions in transit: while our systems deliver a submission to the places listed above, a temporary copy is kept for at most 7 days and deleted as soon as delivery succeeds.
- Contact form messages: as long as we need them to answer you and follow up, and no longer than 24 months after our last exchange, unless you become a client.
- Marketing consent: until you withdraw it, and the consent record for as long as the law requires us to prove it.
- Client records: as set out in our agreement with your organization and as the law requires.
How we protect it
Access to personal information is limited to SB Software staff who need it, through individual staff accounts. Information is encrypted in transit. Our internal tools are not reachable from the internet without signing in.
If an incident involving your personal information presents a risk of serious harm, we will notify you and the Commission d'accès à l'information du Québec as the law requires.
Your rights
You can ask us to:
- tell you what personal information we hold about you and give you a copy;
- correct information that is inaccurate or incomplete;
- withdraw your consent, including to marketing emails (also through the unsubscribe link);
- delete your information when we no longer need it or it was collected without your consent;
- give you your information in a structured, commonly used technological format.
Write to privacy@sbsoftware.ca. We will answer within 30 days and may ask you to confirm your identity first.
If you are not satisfied with our answer, you can complain to the Commission d'accès à l'information du Québec or the Office of the Privacy Commissioner of Canada.
Children
Our services are for businesses. We do not knowingly collect information from anyone under 14.
Changes
We will update this page when our practices change and show the new date at the top. Significant changes will also be announced on this website.