Enterprise-grade security built in from day one — not bolted on as an afterthought.
SimpleTurn handles sensitive property data and prospect conversations. We take that responsibility seriously. Our security architecture was designed for enterprise PMCs from the start — because retrofitting security never works.
This page details our technical security controls, data handling practices, and compliance posture. If you have additional security questions, contact security@simpleturn.ca.
All SimpleTurn data — property information, prospect conversations, user accounts, analytics — is stored and processed exclusively in Canada.
Multiple layers of protection for your data at every stage.
SimpleTurn AI agents are powerful, but they're not unsupervised. We've built multiple layers of control to ensure accuracy and prevent harmful outputs.
Your edits always take precedence over AI research.
Our system cross-references multiple sources and flags conflicts.
Agents only answer from their dossier. If info isn't there, they say so.
Your data is never used to train models. Not for other clients, not for anyone.
Every AI decision, conversation, and edit is logged for review.
Meeting the highest standards for data privacy and protection.
We comply with Canada's PIPEDA. All data handling follows the 10 fair information principles.
Compliant with Alberta PIPA, BC PIPA, and Quebec Law 25.
Actively pursuing certification. Expected Q3 2026.
Our practices meet GDPR requirements for EU-based prospects.
Canada's Anti-Spam Legislation — built-in consent tracking, sender identification, unsubscribe mechanisms, and quiet hours. See details below ↓
How SimpleTurn keeps your outbound communications compliant with Canada's Anti-Spam Legislation.
Every message from a SimpleTurn agent includes your property management company's name, mailing address, and contact information — as required by CASL for all commercial electronic messages.
CASL s.6(2)(a)–(c)Every automated message includes a one-click opt-out link. CASL requires opt-outs be processed within 10 business days — SimpleTurn processes them instantly and suppresses all future messages.
CASL s.6(2)(c)Outbound messages are held between 9 PM and 8 AM local time. No commercial electronic message is sent outside reasonable hours — protecting both your prospects and your reputation.
Best practiceSimpleTurn tracks express and implied consent per prospect with timestamps. Implied consent from an inquiry automatically expires after 6 months. Express consent is recorded with source and date for audit.
CASL s.10(1)–(3)Every message, consent record, and opt-out is logged and exportable. If the CRTC or your compliance team needs records, they're available on demand with full chain-of-custody.
CASL s.6, s.10SimpleTurn provides the compliance tools — but under CASL, the sending organisation retains accountability. Here's what you need to do:
For more on CASL obligations, see the CRTC's CASL guidance. Questions? Reach us at compliance@simpleturn.ca.
If you discover a security vulnerability in SimpleTurn, we want to hear about it. Please report vulnerabilities responsibly to security@simpleturn.ca.