Canadian software development firm with compliance experience

NorthSight Technologies is a Canadian software development firm with compliance experience. We are based in Ontario. We build custom web and mobile software for companies whose buyers run a security or privacy review before they sign. That means the software has to work, and it also has to stand up to that review. Start with a free introductory call.

Who this is for

Most companies that look for a development firm with compliance experience are in one of three spots:

• You sell software to regulated buyers. A college, a hospital or a public body wants your product, and their security team has sent a questionnaire you need to pass.
• You are building something new that will hold sensitive data. Health records, student records or personal information. You want it built properly the first time.
• You already have software that failed a review. A deal is stuck, and you need the gaps fixed in the code, not just better wording on a form.

A typical client of ours is a health or education software vendor selling to Canadian colleges. The product is only half the job. Passing the buyer's review is the other half.

Compliance frameworks we build for

These are the frameworks Canadian buyers ask vendors about most often, and what each one means for the software.

• SOC 2. An independent audit report on how a company protects customer data. We build the access controls, logging and change tracking an auditor will look for, so you have less to fix when the audit starts.
• HECVAT. The security questionnaire colleges and universities send to software vendors. We help you answer it and fix the code behind the answers. See our HECVAT help for SaaS vendors.
• PIPEDA. Canada's federal privacy law for private-sector organizations. We design how personal information is collected, stored, accessed and deleted so you can show what happens to it.
• PHIPA. Ontario's health privacy law. For health software we build role-based access, audit logs of who viewed which record, and Canadian hosting when the buyer asks for it.
• Quebec Law 25. Quebec's privacy law for organizations that handle personal information of people in Quebec. We design consent handling, data export and deletion into the product.
• Protected B. A Government of Canada security level for sensitive information, such as personal records. We design for its data residency and access control requirements. Security screening and hosting approval are handled with the department.
• AODA. Ontario's accessibility law. It requires public sector bodies and organizations with 50 or more employees to make their public websites meet WCAG 2.0 Level AA. We build interfaces to that level.

What compliance experience looks like in the code

Compliance is mostly ordinary engineering done carefully and written down. In practice it means:

• Access control. Every user has a role, and the software enforces what each role can see and do.
• Audit logs. The system records who did what and when, and those records are protected against quiet edits.
• Encryption. Data is encrypted when it moves and when it is stored. Keys and passwords stay out of the code.
• Data residency. Data is hosted in Canada where the buyer requires it, and we can show where it lives.
• Safe dependencies. Third-party libraries are tracked and updated, so known flaws do not sit in production.
• Evidence. Architecture diagrams, data flow maps and written answers that match what the code does.

These choices cost little when they are made at the start. They cost a lot when they are added the week before a review. If you want an outside read on software you already have, our secure code review is the place to start.

How to compare software development firms on compliance

Many firms list compliance on their website. These questions help you tell who has done the work:

• Who writes the code? Ask if the senior people on the sales call are the people who build it.
• Where does the data live? Ask which country hosts it, and who can access it.
• Can they show the controls? Ask to see how access, logging and encryption work in something they built.
• Have they been through a buyer's review? Ask which questionnaires or audits their past work has faced.
• What will they not do? A good firm tells you where the auditor's and lawyer's jobs begin.

What we do and what we do not do

We design, build and fix software. We review code. We prepare the technical parts of a security questionnaire and help you answer the rest accurately.

We are not an audit firm or a law firm. A SOC 2 report comes from an independent CPA firm. Legal advice on privacy law comes from your lawyer or privacy officer. We work alongside them and give them what they need from the engineering side.

How we work

The engineers who scope your project are the engineers who build it. There is no hand-off to a junior or offshore team. Our principals bring 28+ years of combined engineering across government, enterprise and consumer software.

We can start from a new idea, a prototype or a codebase you inherited. For the full list of what we build, see custom software development in Canada.

Frequently asked questions