Every Canadian privacy compliance feature.
Nothing you don't.
PIPEDA, Law 25, CASL, breach management, vendor risk, data governance, and trust signals — in one Canadian platform.
60+
Features
14
Privacy & health acts
EN/FR
Bilingual
🍁
Hosted in Canada
Your compliance command center
AI Governance
Govern every AI system against the EU AI Act, ISO 42001, and NIST AI RMF. Registry, classification, obligations, and documentation in one place.
AI Gateway
Govern AI at runtime — route your AI calls through Valdra to block prompt-injection and data loss in prompts, redact personal data, enforce model allow-lists, and audit every call. Monitor first, enforce when ready.
AI Systems Registry
A living inventory of every AI system you build or buy — model, provider, purpose, data, and risk tier in one source of truth.
EU AI Act Risk Classifier
Guided questionnaire classifies each system as prohibited, high-risk, limited, or minimal — across Art. 5, Annex III, GPAI, and Art. 50.
AI Obligations Map
Every obligation each tier triggers — conformity assessment, human oversight, transparency — tracked with status and one-click tasking.
AI Documentation
Annex IV technical files, model cards, and Fundamental Rights Impact Assessments generated from your registry — versioned and refreshed when models change.
Shadow AI Discovery
Surface unsanctioned AI tools in use across your org, triage by risk, and promote sanctioned tools into the registry with one click.
Automated assessments for every Canadian law
PIPEDA Assessment
AI-guided walkthrough of all 10 fair information principles. Scored gap report with OPC citations and auto-generated accountability docs.
Law 25 Assessment
Full Bill 64 coverage — PIA triggers, Law 25 heightened consent, CAI filing readiness — bilingual EN/FR.
CASL Assessment
Consent mapping, CEM definition review, unsubscribe mechanism audit, and sender ID check — with CRTC enforcement context.
Plain-English Law Summaries
All 14 Canadian privacy & health acts explained without legalese. Four-section format (requires / applies-to / enforcement / penalty) in EN + FR.
Federal Privacy Reform Tracker
Bill C-27 died in January 2025. Bill C-36 is at second reading and is not law. History, status and a reform readiness score.
Privacy documents and impact assessments
PIA Wizard
8-step Privacy Impact Assessment satisfying Law 25 §3.3 and OPC framework. Risk matrix with stakeholder sign-off and PDF export.
CASL Consent Center
Timestamped consent records with IP, channel, exact consent language. Express vs. implied tracking, 10-day unsubscribe queue, CRTC export.
PIA Threshold Screener
A quick pre-screener decides whether your project actually needs a full PIA under PIPEDA / Law 25. Saves hours when one isn't required.
AI-Assisted PIA Drafting
AI assistance drafts your Privacy Impact Assessment from a plain-language project description. Multi-stakeholder reviews, inline statutory citations.
Multi-Language Intake
Submit privacy requests in English, French, or 5 Indigenous languages (Cree, Inuktitut, Ojibwe, Anishinaabe, Mi'kmaq). Accessibility win.
Breach Autopilot: RROSH test, regulator reports, letters
RROSH Assessment
Conversational Real Risk of Significant Harm evaluation. Step-by-step AI guidance through statutory factors — documented for review.
OPC Report Builder
Auto-generates OPC breach notifications and CAI filings from your incident data. Plain language drafts, ready in minutes.
Notification Letters
Auto-drafted individual notification letters for affected parties — plain-language, PIPEDA-compliant, bilingual. Tracks send status.
Mass Breach Notification
Upload 100K affected individuals as CSV. Bilingual personalized notifications, delivery tracking, opt-out, throttled send, audit log. PIPEDA + Law 25 compliant.
Breach Register
2-year PIPEDA-required breach retention log. Searchable, exportable, and audit-ready for OPC review.
Third-party risk, fully mapped
Vendor Library
Pre-built compliance profiles for common Canadian SaaS tools with pre-assessed PIPEDA status and CLOUD Act risk ratings.
DPA Tracker
Auto-generate DPAs with Canadian standard contractual clauses. Track signed/requested/missing status across all vendors.
Shadow AI Detection
Detects unauthorized AI tools used by your team. Flags CLOUD Act exposure and auto-answers 70%+ of vendor questionnaires.
Cross-Border TIA
Law 25 art. 17 + GDPR Schrems II Transfer Impact Assessment. Country legal maps, CLOUD-Act scoring, supplementary measures, CAI-ready export.
Penalty Calculator
Calculate maximum penalty exposure under PIPEDA, Law 25 ($25M / 4% revenue), and CASL ($10M). Multi-violation scenarios, recent enforcement citations.
STRIDE Threat Models
STRIDE-based threat modelling. Data flow diagrams, mitigation library from your controls, SOC 2 CC3.2 evidence, reusable templates.
SOC 2 and ISO 27001 readiness
ISO 27001
ISO 27001 readiness with guidance, evidence requirements, and status tracking. Gap analysis against your current posture.
Control Library
Unified control browser across SOC 2, ISO 27001, PIPEDA, and NIST. Tag controls, assign owners, track completion.
Evidence Collection
Upload PDFs, screenshots, policies as evidence per control. Version-controlled, audit-trailed, exportable evidence packages.
Authenticator App 2FA
Standard TOTP via Google Authenticator, Authy, 1Password. QR setup, magic-link-then-code flow, recovery codes.
Login History (SOC 2 CC6.1)
90-day login audit with IP, country, device, and auth method. Required for SOC 2 CC6.1 logical access evidence.
Know your data. Map it. Govern it.
Data Discovery
Map every system processing personal data — what you hold, where it lives, who accesses it. Automated and continuous.
Data Lineage Maps
Sankey-style layered view: Sources → Apps → Storage → Vendors. Auto-derived from your vendor inventory. PII-type filter chips, CLOUD-Act flags, PNG export.
Privacy Score & ROPA
Auto-populated Register of Processing Activities required by Law 25. Jurisdiction scoring with data residency tracking.
Data Flow Maps
Visual maps of PII movement through your organization — intake, storage, sharing, disposal. Export for PIA docs.
Retention Schedules
Define retention periods per data category. Automated alerts when periods expire and deletion workflows.
Turn compliance into a competitive advantage
Readiness Mark
The Valdra readiness mark for your website, email footer, or proposals. It shows the score Valdra measured and the date, with a verify link.
Cookie Consent Banner
PIPEDA/CAI-compliant cookie consent with granular controls. Single script tag. Consent logs stored in Valdra.
Privacy Notice Embed
Auto-updated privacy notices that sync with your data map. Change data practices — notice updates automatically.
Subprocessor Disclosure
Public list of third-party vendors that process your customers' data — auto-rendered from your Vendor Inventory. DPA + SOC 2 standard practice.
Inquiry Inbox + NDA Vault
Capture security questionnaires from prospects. Email alerts, NDA-gated document vault, per-inquiry audit trail, quarterly insights.
Status / Incident Page
StatusPage.io-style public incident page. Subscriber notifications, severity tracking, post-mortem templates. No more $99/mo SaaS.
Custom Report Builder
Drag-and-drop composer with live data binding. Branded bilingual PDFs for OPC submissions, SOC 2 evidence, board updates.
Board-Ready Quarterly Pack
One-click quarterly board pack: compliance score trend, top-5 risks, breach summary, vendor changes, training completion, regulatory horizon.
Custom Course Upload
Upload your own training content in Markdown — sector-specific (fintech, healthcare), internal-policy-specific, or new-hire-onboarding.
Connect everything you already use
All Integrations
Connect Valdra with your existing tech stack — AI assistants, cloud providers, HR platforms, and more. MCP Server, REST API, and no-code webhooks.
Document Drafter
Generates privacy policies, DPAs, CASL consent notices, employee privacy notices, and cookie policies — bilingual, jurisdiction-specific, ready to sign.
Breach Triage
AI-guided breach response from first report to OPC/CAI filing. Runs your response clock against a recommended 72 hour internal target (not a legal deadline), the RROSH determination, notification letters, and evidence package.
PII Scanner
Shielk-powered entity detection built directly into Valdra. Discovers undeclared PII in your data inventory, docs, and cloud assets, including Canada specific identifiers.
Vendor Risk
Reviews SOC 2 reports, flags CLOUD Act exposure, and scores vendor DPAs against PIPEDA transfer requirements. Prioritizes by data sensitivity and volume.
Gap Analyst
Identifies compliance gaps across all active frameworks, ranks them by regulatory severity and remediation effort, and links each gap to the specific statute.
Regulatory Monitor
Monitors the federal Privacy Commissioner and Alberta OIPC, plus Parliament. Translates new guidance into plain-language action items specific to your compliance profile.
Training Module
Employee privacy awareness training tailored to your industry and applicable laws. Completion tracking, attestation records, and bilingual delivery.
Start your free compliance assessment
No credit card, no consultant required. See your PIPEDA, Law 25, and CASL score in 10 minutes.
