Your data
Where it lives, who can see it, how you get it back.
Three questions every owner should ask a supplier and most never get a straight answer to. Here are ours, with the dates things were checked.
Where the server is
Your data sits on a server hosted by OVHcloud in Quebec, Canada. It does not leave it for analytics, for advertising or for a third party.
- Host
- OVHcloud
- Region
- Quebec, Canada
- Checked
- The production address 148.113.184.5 was checked on 2026-09-11
Email leaves the server to be delivered, and card payments go to Stripe, which holds the card details so we never do. Those are the only two places anything travels to.
Backups, and getting back from one
A copy is taken every night at 03:00, server time.
- The copy is made with SQLite's own backup API, so it is consistent even if someone is booking while it runs.
- Restoring checks the copy first — that it is a real database, that it passes an integrity check, and that it holds the tables and businesses it should — before anything is replaced.
- The live database is moved aside with a dated name, never overwritten. In the worst case you end up with the database you had and one extra file.
A backup nobody has restored is a file, not a backup. The restore path has an automated test that runs with the rest of the suite.
The one-click export
From the dashboard, any day, without asking anyone: a JSON file with everything, and a ZIP of CSV files that open in any spreadsheet. This is what comes out.
- Clients, with their contact details and notes
- Logged calls, emails and visits
- The services you offer, in both languages
- Your opening hours
- Days and hours you blocked off
- Appointments, past and future
- Support tickets and requests
- Every reply on those tickets
- The questions and answers your chat uses
- Chat conversations
- Every message in those conversations
- Invoices you issued, with tax and totals
- Your email templates
- Your business settings
Passwords and tokens never leave, not even hashed, and nothing from another business is ever in your file.
Who can reach it
- You, and the colleagues you invite. Staff accounts cannot change your settings.
- One person at DeMark — the advisor — has access to the server for support and maintenance.
- No analytics company, no advertising network and no reseller has a copy.
- Every query in the software is filtered by business, so one client's data cannot appear in another's screen.
PIPEDA and PHIPAA, in plain words
Two laws come up. Neither is a badge you buy; both are things you do.
PIPEDA (federal)
New Brunswick has no general private-sector privacy law of its own, so the federal one applies to commercial activity. In practice it means collecting only what you need, keeping it safe, telling people if something goes wrong, and keeping a record of any breach for two years. If something happened to your clients' data, you would hear it from us.
PHIPAA (New Brunswick health)
If you are a custodian of personal health information, section 52(3) says you need a written agreement with the person who manages that information on your behalf — that would be DeMark. Section 49(1)(c) says the patient and the Ombud get told after a loss or unauthorised access. Ask for the agreement before you sign up, not after.
Credentials we hold for you
Some things cannot be hashed, because we have to present them to another server on your behalf — your email password, for example.
- Those are encrypted with AES-256-GCM, which authenticates as well as encrypts: a tampered value fails to decrypt instead of returning nonsense.
- The encryption key lives in the server's environment file, never in the database and never in the code repository. Someone who walked off with the database file would have noise.
- Card details are never held here at all: those live with Stripe, and payouts go straight to your own Stripe account.