This policy reflects the controls implemented in the current platform and must be reviewed against the final legal entity, vendors, data flows, and province-specific obligations before production publication.
Security principles
MapleFind uses defence in depth, least privilege, secure defaults, data minimization, separation of public and restricted records, human publication approval, and recoverable change management.
Platform controls
Publishing integrations require authenticated HTTPS requests, versioned schemas, strict types and limits, controlled taxonomies, idempotency, pending-only authority, and an emergency submission switch. Restricted provenance is excluded from public REST output and unsaved previews.
Operational controls
Production discovery is read-only until an approved deployment. Backups must be taken and verified before database changes. Credentials, salts, private keys, application passwords, private contacts, and raw evidence are never committed or printed into documentation.
Report a vulnerability
Send a concise good-faith report to security@maplefind.ca with affected URL, impact, and reproduction steps. Do not access other people’s data, disrupt the service, persist access, send extortionate demands, or publicly disclose before we have a reasonable opportunity to respond.
Incident and privacy breach response
The response process covers containment, preservation, investigation, risk assessment, recovery, required notices, lessons learned, and breach recordkeeping. Privacy incidents are assessed for sensitivity and probability of misuse, including whether they create a real risk of significant harm.
Policy status
This page describes the controls built into the platform. Production launch still requires named owners, vendor review, access reviews, backup restoration testing, monitoring, a contact rota, retention schedules, and counsel review. Last implementation review: July 26, 2026.