Compliance, in plain language.

Privacy · Canada

PIPEDA & Canadian privacy

PIPEDA governs how private-sector organizations handle personal information, and Wynura is designed to operate within it. The stack collects only what the workflow in front of it needs — an order, an invoice, a borrower's document — and uses it only for that purpose. Safeguards are SEC-01 to SEC-03: encryption in transit and at rest, role-based access, least privilege by default. Each customer's records are kept as that customer's records — never sold, never shared, never used to train models for anyone else — and can be exported or deleted at any time (SEC-02).

Anti-spam · Canada

CASL — Canada's anti-spam law

The automation sends email only inside the customer's own existing business relationships: their suppliers about their purchase orders, their brokers and borrowers about their files, their customers about their orders. It never works bought lists or cold prospects. Every automated message identifies the business it acts for, a reply ends the chase for that item on the spot, and an opt-out is honoured immediately — the sequence stops, and the stop is written to the audit log. Consent in a business relationship is respected by the design of the machine, not by someone remembering to check a box.

Model risk · Financial institutions

OSFI Guideline E-23 — model risk

For lender deployments that sit inside institutions answering to OSFI's model risk expectations — and for private lenders who hold themselves to the same discipline — the stack is built for human oversight end to end. Automation supports decisions; it never makes the final one. In the Lender Edition, approval and decline stay with the lender's underwriters, always (SEC-06). Every automated action lands in the audit log, escalations arrive with a plain-language summary of what happened and why, and a person can inspect, override or stop any sequence. Where a conversation needs a person rather than an answer, the stack hands off to a live agent with the full record in view.

Security controls · Alignment

SOC 2 — aligned, not certified

SEC-04 states the position plainly: Wynura's controls are designed around the SOC 2 Trust Services Criteria — security, availability and confidentiality — so a customer's own vendor review has something concrete to examine. That is an alignment statement. Wynura is not SOC 2 certified and has not completed a SOC 2 audit, and this page will say so for as long as it is true. The posture is published so it can be checked instead of taken on faith.

Management systems · Alignment

ISO/IEC 27001 & 42001 — aligned, not certified

The way the platform is run — how access is granted and reviewed, how changes are controlled, how incidents are handled, how automated behaviour is governed and supervised by people — is aligned to the management-system principles of ISO/IEC 27001 (information security) and ISO/IEC 42001 (AI management). Alignment of approach is the claim. Wynura is not certified to either standard.

Residency & protection

Data residency and per-customer isolation

Each customer chooses Canada or United States data residency (SEC-02) — Canadian lenders handling borrower files typically choose Canada. Data is encrypted in transit and at rest (SEC-01), access is role-based and least-privilege (SEC-03), and tenants are isolated at the data layer: one customer's record is never visible inside another's, and one lender's files are never visible to another. Isolation is enforced by the system, not by staff care.

Independently scanned November 13, 2026 — SSL Labs A+ · Mozilla Observatory A+ (110/110, 12 of 12 tests) · securityheaders.com A+. TLS certificate by Let's Encrypt, auto-renewed.

Accessibility · Ontario

AODA & WCAG-conscious design

Customer-facing surfaces are designed with WCAG 2.1 AA principles in mind — semantic structure, full keyboard operation, visible focus, text alternatives for imagery, and a contrast-checked palette — to support the accessibility expectations Ontario businesses work under, including the AODA. This website is built the same way, so the claim can be tested on the page you are reading. It is a design discipline, stated as such — not a conformance certificate.

Records · Every action

Audit trail and records

Every automated action the stack takes — each chase message sent, each match made, each change to the shared record, each escalation — is written to an audit log that names who or what did it, when, and on which item. Nothing is queued or sent outside that record: outbound work is prepared in a controlled outbox and released under the deployment's rules, so the log is the complete history, not a sample. The customer can review and export it — it is their record of what their software did, and it is the first thing produced when a supplier, a broker or an auditor asks why something happened.