PaymentEvolution is a Canadian payroll, HR, and payments company federally incorporated in Canada and headquartered in Ontario, registered with FINTRAC as a money services business and with the Bank of Canada as a payment service provider under the Retail Payment Activities Act. Ownership and control rest only with Canadian residents, and no single non-Canadian person or entity holds voting shares.
Customer payroll, HR, and payment data is stored and processed in Microsoft Azure's Canada Central and Canada East regions, with backups and disaster recovery held in Canadian regions only. Data is encrypted with AES-256 at rest and TLS 1.2 or higher in transit, and key material is held in Azure Key Vault in a Canadian region. Inference on regulated customer data runs on hardware PaymentEvolution operates in Canada. Support correspondence and product telemetry are processed by the named subprocessors listed in the full spec sheet, and customers receive 30 days written notice before any subprocessor handling personal information is added or replaced.
PaymentEvolution maintains no establishment in the United States and is not a covered provider under the CLOUD Act, so United States authorities cannot compel the company directly to produce customer data held in Canada. Microsoft Corporation supplies the underlying infrastructure and remains subject to United States legal process, and PaymentEvolution relies on Microsoft's published commitments to challenge orders directed at enterprise customer data. Section 215 of the USA PATRIOT Act lapsed on March 15, 2020 and applies to no provider today.
Agreements are governed by the laws of Ontario and the federal laws of Canada applicable therein, with disputes heard in the courts of Ontario. Privacy obligations arise under PIPEDA, Quebec Law 25, and the substantially similar statutes in Alberta and British Columbia.
