Security updates
Dated changes to our security and to the security page, newest first. Only changes that shipped are listed.
Three more lines that said too much, corrected
A new test bans phrases the 18 October check had disproved, and it found more of them. Two industry pages and one case study promised that data stays inside your own systems. That is more than we can say: the AI models process what a task needs, in the United States, and model makers may keep requests for a short time to watch for abuse, under their own published terms. All three are corrected.
A rebuilt security page, a trust center and a disclosure policy
The security page now follows one request from sign-in to receipt, says where each piece runs, maps our controls to your regulator and to the OWASP list of agent risks, and lists what we do not hold yet. It also says where the shared sign-in service runs: Vercel, in Washington, D.C. Only its database of accounts is in Montreal. The outside-service list has its own page, with the certifications each service publishes and a change log. A disclosure policy and a security.txt file are published.
The disclosure policyadvizr.ca moves to Next.js 16.3.8
The website's framework moved to Next.js 16.3.8, which fixes two critical advisories reported against the version before it, one of them in image optimization, and several high ones.
Sign-in is one shared service, and the page says what it holds
Every client deployment sends its error reports to the shared sign-in database. Keys and tokens are stripped first, but an error message can still carry a name or a line of text. The page used to say sign-in was kept apart from client data. It now says what sign-in holds.
Where each piece runsSecurity claims checked against the platform code
We checked the security claims across advizr.ca against the platform code and live reads of our hosting, and corrected 66 that were false or overstated. A test now fails the build if a disproved claim comes back. The outside-service list grew from 7 services to 20.
The outside servicesNo Undo on an email that has gone out
The homepage's activity example offered Undo on a sent email. The Platform cannot recall an email once it leaves, so the example no longer offers one.
Questions about an update, or a change we missed? Write to info@advizr.ca.
Run your whole company on AI.
Tell us how your business runs. If we're not the right fit, we'll say so on the call.
Your custom strategy and systems, delivered in under a month. Or we work for free until they are.
The AI operating layer for enterprises.