Bill 194 Compliance Matrix
How Argraide meets Ontario's privacy requirements for educational technology.
Last updated: May 14, 2026
21
Requirements checked
21
Compliant items
0
Student PII fields collected
Data Residency
Data must be stored in Canada
All data hosted in AWS Montreal (ca-central-1)
No transfer to foreign jurisdictions without consent
Data never leaves Canada. No cross-border transfers.
Data Minimization
Collect only necessary personal information
We collect 0 (zero) fields of student PII. Only randomized emoji identifiers.
Purpose limitation for collected data
Data used solely for educational progress tracking. No marketing or advertising.
Retention limitation
Student data auto-purged at end of school year or upon teacher request.
Student Privacy (MFIPPA/FIPPA)
No collection of student names
Students identified by random usernames only.
No collection of student emails
No email required. Authentication via emoji-based passphrase.
No collection of biometric data
Not collected. No facial recognition, voice, or fingerprint data.
Parental consent for students under 13
Not required. Zero PII architecture means no personal information to consent to.
Encryption & Security
Data encrypted in transit
TLS 1.3 for all connections. HTTPS enforced.
Data encrypted at rest
AES-256 encryption on database storage.
Secure authentication
Teachers: Supabase Auth with bcrypt hashing. Students: Zero-knowledge emoji login.
Access controls
Row-level security (RLS) policies. Teachers only see their own classes.
Zero-Knowledge Architecture
Student nicknames protected
Client-side AES-256-GCM encryption. Server never receives plaintext or key.
Key derivation
PBKDF2 with 600,000 iterations (OWASP 2023 recommendation).
Decryption capability
Platform cannot decrypt nicknames. Only teacher with passphrase can.
Transparency & Accountability
Clear privacy policy
Published at /privacy. Plain language. Reviewed periodically.
Data Processing Addendum available
Available at /dpa for institutional customers.
Contact for privacy inquiries
support@argraide.com
Third-Party Services
Vetted subprocessors only
Supabase (Canada), Stripe (PCI-DSS), Vercel (no student data).
AI processing disclosure
AI generates activities only. No student data sent to AI providers.
Technical Specifications
Infrastructure
- • Database: Supabase (Postgres) — Canada (Montreal) primary
- • Hosting: Vercel Edge Network
- • CDN: Vercel CDN (no PII cached)
- • Payments: Stripe (PCI-DSS Level 1)
Encryption Standards
- • In Transit: TLS 1.2+ (1.3 preferred)
- • At Rest: AES-256
- • Nicknames: AES-256-GCM (client-side)
- • Key Derivation: PBKDF2-SHA256, 600K iterations
For formal verification or to request a third-party audit, contact support@argraide.com.