Privacy Policy

Effective date: July 21, 2026 · PI-ATAWI Investment Enterprise

Template. This policy is a working draft for the demonstration phase and must be reviewed by legal counsel before any external client organization is onboarded.

Who we are

PI-ATAWI ONE is an accounting and business-management platform operated by PI-ATAWI Investment Enterprise (“we”, “us”). This policy explains what information the platform handles and how it is protected.

Data residency

Your data is stored and processed in Canada, in the AWS ca-central-1 (Montréal) region. This supports Canadian data-sovereignty expectations and is aligned with OCAP® principles: your organization owns, controls, and can access and export its own information at any time.

What we handle

Account information you provide — name, email address, and organization details. Business records you enter — chart of accounts, contacts, journal entries, and related documents. Security metadata — sign-in events and an immutable audit log of changes, used to protect your account.

How your information is used

Solely to provide the service to you: to operate your books, authenticate you, keep an audit trail, and support your account. We do not sell your data, and we do not use one organization’s data for another.

How it is protected

All traffic is encrypted in transit (HTTPS/HSTS) and data is encrypted at rest by our infrastructure providers. Access is enforced at the database with row-level security (an organization can never read another’s data, even if application code were wrong). Multi-factor authentication is required for roles that can move financial records, and every change is recorded in an append-only audit log.

Your data is yours

An organization owner can export all of the organization’s data as CSV files at any time from the Reports area — this is both a feature and our commitment to data portability. You may request access, correction, or deletion of personal information by contacting us.

Service providers

We rely on Supabase (database/authentication, ca-central-1) and Vercel (application hosting) to operate the platform. At go-live, payment processing (Stripe) and transactional email (Resend) may be added; each is engaged only to deliver the service and is bound to protect your data.

Retention

Financial records are retained for as long as your organization uses the platform and as required by applicable record-keeping law. Nothing financial is deleted within the platform — accounts and contacts are deactivated, and posted entries are reversed rather than erased.

Contact

Questions about this policy: general@pi-atawi.com.