Pulsoq by Avivoq. Last updated: October 2026.
In plain words. What a diagnostic gathers is sensitive: what people say about their work, and how a company really runs. It stays in Quebec, it is locked with a key per engagement, and people's names are replaced by codes before any AI reads a text.
| What | Where |
|---|---|
| The Pulsoq server and its daily backups | OVHcloud, Beauharnois, Quebec |
| The encryption keys | OVHcloud's key management service, Beauharnois, Quebec. The keys never leave it. |
| The database and its backups | Supabase, Canada (Central) region, Montreal, in a database of Pulsoq's own |
Names, contact details, the client company's identity, survey answers given with a name, and original files are encrypted. Each engagement has its own key in OVHcloud's key management service; every opening of a key is logged. Roles that open this information need a second factor at sign-in.
People's names in interviews and notes are replaced by codes, a scan looks for names missed, and a person reviews the text before anything is read from it. The AI then receives that text, and the company's documents and photos.
| AI provider | What it receives, and what it keeps |
|---|---|
| Ollama, by default, with open models | The text with names replaced by codes, documents and photos. Its policy says it processes them only for the request, keeps nothing and trains on nothing; processing may take place in the United States. |
| Claude, by Anthropic, when chosen | The same, processed in the United States. |
| Your workspace's own account | A workspace may use its own account with another provider, under its own agreement with that provider. |
Pulsoq checks every answer: each fact must quote its source word for word, and every number in a report is checked against its source. An engagement that requires zero data retention calls only through an account that has it.
Each consulting firm and each company has its own workspace, in its own database schema. The workspace comes from the signed-in person's membership, never from the address typed, and a test of every release checks that no workspace reaches another. Sign-in is through Google; Microsoft accounts are coming.
We open a workspace only to support it, under a grant its administrator issues for at most 72 hours and can revoke. That access is read-only, encrypted information stays closed to it, and every page we open is written to the workspace's log.
An anonymous survey never reports a group of fewer than five people, nor a group that could be worked out by subtracting one published group from another.
Each engagement has a retention date. When it passes, the evidence is deleted and the engagement's key destroyed, so nothing it encrypted can be opened again. The approved reports remain.
Interview guides, reports and workbooks you download carry an invisible mark that identifies the workspace, the engagement and the download. It protects the library and method behind Pulsoq; it changes nothing you can see or print.
Pulsoq follows Quebec's Act respecting the protection of personal information in the private sector and the federal Personal Information Protection and Electronic Documents Act: a person in charge of protecting personal information, an assessment before information leaves Quebec, a register of incidents, and the rights described in our privacy policy.