Privacy
Kaution holds genuinely sensitive information about real people: injury descriptions, photographs, handwritten signatures and training certificates. This page says plainly what we collect, why we have it, where it is kept, and how to get a copy of it or have it deleted.
Two kinds of people use Kaution
Employers buy Kaution and decide what goes into it. Workers are added to it by their employer. If you are a worker, you did not sign up for Kaution and your account was created for you. That does not reduce your rights, and you do not need your employer's permission to use them. Write to us directly and we will not send you back to your employer first.
What we collect, and why
Account details
Your name, email address, job title, company role and access level.
Why: So you can sign in, and so colleagues can see who signed, inspected or reported something.
Your password is stored only as a one-way hash. We cannot read it.
Incident records and photos
What happened, when and where, how serious it was, who was involved, injury descriptions, witness statements and any photographs attached.
Why: It is the incident report. Ontario's Occupational Health and Safety Act requires employers to record incidents, and COR certification requires documented investigations.
This is the most sensitive information in the app, and it can describe someone who does not use Kaution at all, such as a visitor or a subcontractor's worker.
Signatures, and location when available
Your drawn signature, the wording you were shown, the time you signed, and your device's location at that moment if it provides one.
Why: The signature is the proof of sign-off a COR audit looks for. The location is shown on the sign-off record and printed on the report.
Location is optional and best effort. The app asks only at the moment you sign, never in the background, and signing still works if you refuse or your device cannot provide it.
Training records
The training you hold, when it was issued, when it expires, and scanned certificates.
Why: COR requires an employer to show its workers are trained, and the app reminds you before a certificate expires.
Certificates usually carry your full name, and sometimes a licence number.
Documents you upload
Safety manuals, policies, procedures and similar files, plus the text extracted from them.
Why: So they can be assessed against the COR standard and kept in your company's document library.
The text of these documents is the one thing that leaves Canada. See below.
Where your information is stored
Kaution runs in Canada, deliberately. The application and its database are hosted on DigitalOcean in Toronto. Uploaded files, photographs, signatures, certificates and database backups are stored with Amazon Web Services in Canada. Email is handled by Zoho in its Canadian data centre.
There is one exception, and we would rather state it than bury it. When Kaution assesses a safety document you upload, the text of that document is sent to Anthropic, the company behind the Claude model, in the United States. The file itself stays in Canada; the text does not. Safety documents routinely contain people's names, so names travel with it. Information held in the United States may be reachable by United States authorities under their law. Nothing else about your account leaves Canada.
If your company subscribes, we also send your company name and one administrator's email address to Stripe to handle payment. No card details ever reach a Kaution server.
What we do not do
- We do not sell your information, and we never will.
- There is no advertising in Kaution, and no advertising identifiers are collected.
- There are no analytics or tracking tools in the app. We do not follow you across other apps or websites.
- We do not collect your social insurance number, date of birth, banking details, health card number, or any biometric identifier such as a fingerprint or face scan.
How long we keep information
Most of what Kaution holds is your employer's safety record, and Ontario health and safety law and WSIB obligations require an employer to keep much of it: injury and first aid records, training records, inspection records and signed sign-offs. It is also the evidence behind a COR certification, which looks back over several years. So we keep those records while your employer needs them, rather than deleting them on a timer.
Where the law does not require a record to be kept, we remove it on request. We are setting written retention periods for each kind of record as part of the legal review of this page, and will publish them here rather than describe periods we have not yet set.
Seeing, correcting and deleting your information
You can ask what we hold about you, ask for a copy, ask us to correct it, and ask us to delete it. Write to support@kautionsafety.com. Tell us your name, the email address on your account and the company you work for. We may ask you to confirm who you are first, because we are not going to hand someone's injury record to a stranger. We will respond within 30 days.
You can also close your own account from inside the app. See deleting your account for exactly what that removes and what is kept.
Where we refuse a deletion because the law requires the record to be kept, we will tell you which records we kept and on what basis, rather than quietly doing nothing.
If you are not happy with our answer
Come to us first at support@kautionsafety.com. You also have the right to complain to the Office of the Privacy Commissioner of Canada, at priv.gc.ca or 1-800-282-1376. If you believe safety records are being misused, Ontario's Ministry of Labour, Immigration, Training and Skills Development handles that, and nothing here limits your right to raise a health and safety concern.
Contact
Privacy questions, access requests and deletion requests all go to support@kautionsafety.com.
If we change how we handle personal information, we will update this page and say so before the change takes effect where it materially affects you.