Compliance & Data Protection
Spatial Data Sovereignty — Canadian-Hosted, Municipality-Owned
Parcel data, address databases, infrastructure layers, and aerial imagery — all hosted in Canadian data centres with full source code ownership. No vendor lock-in. No cross-border data transfer. Complete sovereignty over your authoritative spatial data.
Canadian Municipal Compliance
Municipal & Provincial Regulations
Purpose-built for Canadian municipalities, with full alignment to federal, provincial, and municipal legislation governing public-sector data management.
Ontario
Civic GIS operates within the digital infrastructure requirements of the Municipal Act — supporting property assessment, tax roll integration, public notice requirements, and municipal data governance. Spatial data management follows municipal records retention policies.
Ontario
All spatial data access is logged with user, timestamp, layer, and query details. Property-specific information is protected behind role-based access controls. Public portal layers are curated to exclude personal information while meeting Open Data Directive requirements. FOI requests are supported with spatial query and export tools.
Ontario
Web map applications meet WCAG 2.1 Level AA standards. Screen reader optimized with alternative text for map imagery. Keyboard navigation for all map controls. High contrast mode for visual impairment. Public portal content is accessible without requiring spatial literacy — address search with text results alongside map view.
Ontario
Automated publication pipeline pushes spatial datasets to the municipal Open Data Portal with DCAT/ISO 19115 metadata, multiple download formats (GeoJSON, Shapefile, KML, CSV), and preview maps. Data inventory identifies all spatial datasets for open data assessment. Privacy review workflow ensures no personal information is included in published datasets.
Ontario
Parcel fabric management follows Ontario property mapping standards — including PIN-based parcel identification, legal description formatting, registered plan references, and assessment roll linkage. POLARIS-compatible data exchange for provincial parcel mapping coordination.
Ontario
Emergency Map Viewer provides immediate access to critical infrastructure locations, evacuation routes, flood zones, and hazard areas. Real-time incident mapping during emergencies. Digital twin simulates flooding and infrastructure failure scenarios for emergency planning. Supports municipal emergency response plan spatial requirements.
Ontario
Civic GIS enforces location privacy controls — residential address data is role-restricted, aggregate heat maps replace point-level data for public reporting, GPS tracking data is anonymized after route optimization. Spatial data classification (public, internal, restricted, confidential) applies to every layer. Data sharing agreements govern all external data exchange.
“Compliance is not a feature we bolted on after launch — it is the architectural foundation every line of code is written against. Canadian municipalities deserve a platform that treats their legislative obligations as first-class requirements.”
Civic Engineering
· Platform Architecture TeamRegulatory Compliance
Industry Frameworks
Beyond municipal legislation, satisfies internationally recognized compliance frameworks.
Annual SOC 2 Type II audit covering security, availability, and confidentiality of all Civic platform services including the GIS spatial data infrastructure. Covers data centre operations, access controls, monitoring, and incident response.
- Logical access controls for spatial data with layer-level permissions enforced at the API and web map service level
- Availability monitoring with 99.9% uptime SLA for WMS/WFS endpoints and public-facing map applications
- Confidentiality protections for sensitive infrastructure layers — treatment plants, pump stations, and critical facility locations
- Change management controls for spatial data edits with versioning, approval workflows, and rollback capability
- Annual independent SOC 2 Type II audit covering GIS platform operations with report available under NDA
Information security management system certification. Covers the complete Civic GIS lifecycle — from spatial data ingestion and editing through processing and publication. Risk management framework for geospatial data assets.
- Risk assessment methodology covering geospatial data assets — parcel fabric, address database, infrastructure layers, and aerial imagery
- Access control policy with AD/Azure AD integration, MFA enforcement, and layer-level RBAC for spatial data
- Cryptographic controls with AES-256 encryption for PostGIS databases, imagery storage, and tile caches at rest
- Operations security including change management for spatial edits, data publication, and service configuration
- Incident management procedures for spatial data integrity breaches and unauthorized infrastructure data access
Spatial metadata follows ISO 19115 standards — data source, accuracy, currency, custodian, and update frequency tracked per layer. Open data publication uses DCAT metadata format for national open data compatibility. Automated metadata generation from data lineage.
- ISO 19115 metadata records maintained per spatial layer — source, accuracy, coordinate reference system, and update frequency
- Automated metadata generation from data lineage tracking — source datasets, transformation steps, and publication dates
- DCAT-compliant metadata export for Open Data Portal publication with machine-readable distribution descriptions
- Data custodian assignment per layer with contact information and update responsibility tracking
- Metadata quality validation rules ensuring completeness before spatial datasets are published to open data
Web mapping services follow Open Geospatial Consortium (OGC) standards — WMS for map tiles, WFS for vector features, WMTS for cached tile services. Ensures interoperability with any OGC-compliant GIS client. GetCapabilities documents published for service discovery.
- WMS endpoint compliance with OGC Web Map Service specification for map tile rendering and GetMap requests
- WFS endpoint compliance with OGC Web Feature Service specification for vector feature queries and transactions
- WMTS cached tile services following OGC specification for high-performance map delivery at scale
- GetCapabilities documents published per OGC specification for automated service discovery and client configuration
- OGC filter encoding support for spatial and attribute queries ensuring interoperability with third-party GIS clients
Data Sovereignty
All Spatial Data Stays in Canada — Always
Parcel data, address databases, infrastructure layers, aerial imagery, LiDAR point clouds — all stored and processed exclusively in Canadian data centres. No cross-border data transfer, even for processing. The full source code licence means you can inspect every line of code that touches your spatial data. Municipality retains complete ownership of all spatial data, not just a licence to access it.
Hosting
Canadian Only
Centres
3 Redundant
Encryption
AES-256
Sovereignty
PIPEDA / MFIPPA
Platform Security
Security Capabilities
Click any capability to explore the technical details behind each security layer.
Auditability
Audit Trail Features
Every action is logged, timestamped, and immutable — providing the complete audit trail required by provincial legislation and municipal accountability standards.
Complete edit history for every spatial feature — geometry and attributes
WMS/WFS API call logging with user, endpoint, parameters, and response time
Layer access audit — who viewed or queried which layers, when, from where
Data publication audit trail — who published what to open data, when, with what metadata
User authentication events — login, session duration, role assignment changes
System configuration changes — layer permission modifications, service configuration
Data import/export audit — who imported/exported spatial data, source/destination, format
Automated compliance reports — MFIPPA request support, quarterly governance metrics