Frequently asked questions

Yes. The meo platform holds a SOC 2 Type 2 attestation: an independent auditor verified that its security controls work over time, not just on paper.

For credit cards, meo relies on PCI Booking, a service provider assessed as compliant with the PCI DSS standard at level 1, the most demanding: meo never holds the card number. See Security at meo and Credit cards and PCI compliance.

Yes. The SOC 2 type 2 report and the other documents useful for a vendor assessment are available through meo’s trust centre at trust.documeo.ca. They serve the security questionnaires of your clients, your insurers or your professional order.

Yes. The terms and conditions set an availability target of 99.5%, 24 hours a day, 7 days a week, excluding scheduled maintenance and circumstances beyond meo’s control. For specific needs, a custom service level agreement is available, up to 99.9% availability with service credits if it is not met; it is negotiated with the meo team.

It depends on where you do business. In Canada, the federal law (PIPEDA) is the baseline for private businesses, British Columbia and Alberta have their own private-sector laws, and Quebec’s Law 25 is the most demanding: meo is built to meet it, which also covers what the others require. Laws specific to your sector may also apply.

In Quebec, Law 25 covers every business that collects, keeps or communicates personal information, whatever its size.

meo gives you tools for practices these laws share, but it does not determine which law governs your organisation. If in doubt, ask a legal adviser.

meo puts the tools in place; your organisation uses them. In Privacy, you name your privacy officer, have your privacy policy analysed, keep your vendor, incident and request registers, and publish a public portal where your clients exercise their rights.

Day to day, your client gives their consent before any upload, and meo keeps the proof. You set a retention period per document type, with automatic deletion if you turn it on. You export or anonymise a contact’s data when they ask, and the activity log keeps a record of your team’s actions.

These tools do not replace legal advice. See Set up the privacy tools.

The shortest one that meets your needs and your obligations. Privacy laws generally ask you not to keep information longer than necessary, unless another law or your professional order sets a period. In Quebec, Law 25 asks you to destroy or anonymise it once the purposes of the collection are achieved.

In meo, each document type in the catalogue has its Minimum retention period, in days, months or years; a new type proposes 1 year. Your client sees this period in their consent. For a type to keep without limit, check Keep forever. See Edit a catalogue item.

With controls verified from the outside: the meo platform holds a SOC 2 Type 2 attestation. Your documents are hosted in Montréal, Canada. They are encrypted at rest and in every transfer, backed up every day, and answers to information blocks are encrypted a second time with AES-256-GCM, with a key unique to each space.

Every table in the database enforces its access rules: each user sees only the spaces they have access to, according to their role. Once two-factor authentication is on, the database itself requires its code.

Every release goes through more than 8,000 automated tests. See Security at meo.

Law 25 sets two levels of penalties for a business. Administrative monetary penalties go up to $10 million or 2% of worldwide turnover, if that amount is higher. Penal fines range from $15,000 to $25 million, or 4% of worldwide turnover.

A person can also be awarded punitive damages of at least $1,000 if a court finds an intentional infringement or gross negligence.

Elsewhere in Canada, each privacy law sets its own remedies.

At the organisation level. The Privacy tools, meaning your privacy officer, your policy, your registers and your public portal, apply to the whole organisation and all its spaces. The owner and administrators of the organisation set them up; other organisation users consult them.

A user who has access only to one or more spaces sees the incident register in Privacy, to report an incident to the organisation. See Set up the privacy tools.

Every third party that processes personal information for you: your management or accounting software, your email service, your payment tool, your online storage or a person you entrust files to. meo adds itself, with its assessment, when you activate the register.

For each vendor, meo asks what it is used for, whether a written agreement covers five protection clauses, and how it processes the data. For a vendor that does not touch your clients’ information, choose Does not touch my clients: nothing else is asked.

In their portal, before any upload. When your client opens the request, meo shows them a consent in your name: the purpose of the collection, meaning the reason for the request, each requested item with its retention period, where their documents are hosted and their rights. They check the box and click Accept and continue; without that, they cannot upload anything.

meo records the accepted text, the date and time, the IP address and a device identifier, but not your client’s location. You find them in the Privacy tab of the contact’s record, with an approximate city and region estimated from the IP address. See View a request’s history.

When a PDF or an image (JPEG, PNG, TIFF, BMP or WebP) is uploaded, meo analyses it to recognise its type and spot sensitive information. It recognises, among others, passports, driver’s licences, bank statements and tax documents. The document then carries the mark Contains sensitive information or Document verified, without the details of the information found.

In Documents and in folders shared with a collaborator, the thumbnail of a sensitive document is blurred. Temporary copies made for the analysis are deleted when it ends. Like any automatic analysis, it can be wrong: the document stays accessible in every case, open it to check.

meo never holds the CVC. Your client enters it with their card in the secure form of PCI Booking, a service provider assessed as compliant with the PCI DSS standard at level 1, the most demanding, which keeps it. It is deleted at the latest with the card, on the date you chose: meo proposes 30 days, 12 months at most.

The PCI standard asks you to keep a card only as long as needed. Delete it as soon as the booking or the file is invoiced. See Credit cards and PCI compliance and Ask your client for a credit card.

By limiting what each person sees and keeping a record of what they do. Give each employee access only to the spaces they need, with the lowest role that is enough for their work. Clients’ sensitive information shows only to users who have access to it.

Every change to contacts, documents and requests is logged automatically in the Activity log, with who made it and when, and the Activity panel of each file shows who viewed or downloaded it. Automatic deletion of expired documents also reduces what stays in meo. When an employee leaves, remove their access: see What happens when an employee leaves your business?

Your documents are hosted in Montréal, Canada.

You always have a way to get your data back. In Documents, download a whole folder as a ZIP file, up to 10 GB or 10,000 files per download. On a contact’s record, Export the data downloads their record, the list of their documents and requests, and their consent records.

To keep your own copy, make these downloads at regular intervals.

It is encrypted a second time, with AES-256-GCM, with a key unique to each space, on top of the encryption of all your data. This covers answers to information blocks and encrypted notes in the Info tab.

It stays hidden until a user who has access to the sensitive information of the space’s clients displays it, and meo keeps a record of each display. For others, the Reveal the content button is disabled and meo says “You do not have permission to view sensitive information”. See Can you ask for sensitive information, such as a SIN, without going through a file?

Yes. meo runs in your browser: sign in at app.documeo.ca with your usual account, with nothing to install.

At every sign-in from a new device, meo sends you an alert email. When travelling, turn on two-factor authentication to better protect your account: see Is two-factor authentication available?

Yes, with an authenticator app, such as Google Authenticator, 1Password or Authy. Turn it on in Settings, on the Security page, with Enable 2FA: see Secure your account.

Once it is on, the database itself requires this code before giving access to your documents, contacts and requests. You can also sign in with a passkey, such as Face ID or Touch ID; meo still asks for the 2FA code. Each person turns it on for their own account: an organisation cannot require it for all its users.

Write to support@documeo.ca from your account’s email address. After checking your identity, meo removes two-step verification from your account; you sign in with your password, then turn it back on under Settings > Security with your new device. Resetting your password is not enough: two-step verification is still required at sign-in.

After 15 minutes of inactivity. Two minutes before, meo shows “Stay signed in?”: click Stay signed in to continue. A session lasts 12 hours at most.

If you check Stay signed in on this device when you sign in, your session stays open for up to 30 days. Each person makes this choice when signing in; do it only on a device that belongs to you. Your clients’ portal closes after 30 minutes of inactivity.

No. meo gives you tools to document your practices and apply them day to day. The progress shown in Privacy reflects only the steps recorded in meo: it is neither legal advice nor a certification.

Your organisation remains responsible for its practices: training its team, applying its internal policies, answering its clients’ requests and deciding what follows an incident. For a specific question, ask a legal adviser.

No. The Law 25 Score diagnostic, on meo’s website, calculates a result and can email you a report, but it creates or changes nothing in your account.

To set up your tools, open Privacy in meo. See Set up the privacy tools.

Eight common topics: Organization identity, Information collected, Purposes of collection, Individual rights, Third-party sharing and data locations, Privacy contact details, Cookies and technologies and Complaint process. For each, it says whether the topic is addressed or not clearly addressed; the i icon explains the result.

The analysis reads the link you give or the text you paste, and finds your privacy officer if they are named. It highlights topics to check; it does not say whether your policy complies with the law. See Set up the privacy tools.

From their record. To give them their information, click Export the data, in the Privacy tools card of the Overview or Privacy tab: meo downloads a JSON file with their record, the list of their documents and requests, and their consent records. Their documents themselves download from the Documents tab.

To erase it, click Anonymize this contact, type “delete”, then click Delete and anonymize. Their name becomes “[Supprimé]”, in both languages, their email and phone number are erased, and their documents and notes are permanently deleted. First check your retention obligations, then record the request in the Request register.

With the Privacy tab of their record. The Consents section shows each accepted consent: the message read, the date and time and, under Technical details (audit evidence), the device, the IP address and the consent’s fingerprint. The Activity log in the same tab lists their portal visits, uploads, downloads and signatures.

Their documents stay in their folder with their upload date and their fingerprint, which shows they have not changed, and each request keeps its history. During a professional inspection, download the folder from Documents as a ZIP file; the organisation’s Activity log exports as a CSV file. See View a request’s history.

It depends on the rules of your sector. Privacy laws ask you to collect only the information needed for the purposes you set. If you check identity in person, ask yourself whether a copy is really useful to you: some professional orders regulate this question precisely.

If you must keep a copy, ask for it in meo with a suitable retention period. Your client sees this period in their consent and, if your space has turned on automatic deletion, the document goes to the trash on its expiry date.

Yes. meo is used across Canada, with clients in Quebec and elsewhere. Your client receives their emails and sees their portal in English or French.

The Privacy tools help you document practices that Canadian privacy laws share. To find out which law applies to your organisation, see Does Law 25 apply to your business?

Your documents are hosted in Montréal, Canada. Credit cards are kept by PCI Booking, in the European Union, under some of the strictest privacy laws. See Credit cards and PCI compliance.

Some services around meo, such as sending emails and paying for your subscription, use providers located outside Canada. meo’s privacy policy lists them with their region.

It stays exportable for a while, then is deleted. If you cancel your subscription, or if your trial ends without a subscription, meo keeps your data for 60 days. During that time, your documents remain exportable; reactivate your subscription before the date shown to keep everything. After that, your data is permanently deleted, with no recovery possible.

Before you leave, download your folders from Documents and export your contacts’ data if needed.

A 64-character string computed from a file’s exact content. The smallest change gives a different fingerprint. meo computes each file’s fingerprint at upload and later compares it with the stored file: you know whether it is unchanged.

In a file’s details, the Integrity section shows Fingerprint verified when the two match. meo checks files of 5 MB or less by itself; for the others, click Verify now.

No. meo only confirms that your client has access to the email address or phone number of their request, with a one-time code. If you ask for an ID document, meo receives it and can recognise its type, but it does not check its authenticity.

Identity verification required by your professional order or by law remains yours.

By limiting who sees what and keeping a record of each access. Isolation between organisations and between spaces is built into the database itself: only users who have access to a space see its clients and documents. Your clients’ answers to information blocks are encrypted a second time and show only to users who have access to sensitive information.

Your clients upload their documents in their portal, after a one-time code, rather than as email attachments. Each view and each download of a file is recorded in its Activity panel. Your documents are hosted in Montréal, Canada.

Open Settings > Activity log, under the space (its actions and the organisation’s) or under the organisation (every action). Each row gives the date, the user, the action and the object.

• Search… finds a user’s name, an email or an object’s name, for example a contact or a document.
• 24 h, 7 d, 30 d, All and Custom choose the period.
• Filters narrows the log by Type (Clients, Documents, Requests, Privacy, Members, Settings) and by Operation (Creation, Update, Deletion, Reads and exports).

Export downloads a CSV file of the events that match your filters. The log is reserved for owners and administrators.