Log in Start here

Trust and privacy

Where your documents are stored, who can see them, and the companies and technology behind cDox.

Last reviewed October 7, 2026

Hosting

Stored in Montreal, backed up in Toronto

Servers in Montreal and nightly backups in Toronto, kept for 14 days, on FullHost's all-Canadian network.

Privacy

We don't read your documents

A page is yours alone until you share it. It's encrypted on the way to us, not on our servers, which is what makes search and sharing work.

Our principles

  1. 01

    We never sell your data

    Not to advertisers, not to data brokers, not to anyone. Your documents are never a product.

  2. 02

    You control your data

    You decide who sees each page. Nothing is public until you publish it, and what you delete is gone.

  3. 03

    You can leave

    Download everything as Word, PDF, text or CSV at any time, or use the free API. No one to ask.

  4. 04

    Your content never trains AI

    What you write is never used to train a model or sold to anyone who would. If we ever add AI features, they won't touch your content.

  5. 05

    Paid for by people who use it

    No ads and no investors. cDox answers to the people who use it.

  6. 06

    Built and hosted in Canada

    Made in Victoria, BC, hosted in Montreal, so the money and your documents stay here.

Read the Small Tech essay these come from

I built cDox because I wanted somewhere to write that I could trust with my own words.
Barry Lachapelle Founder of cDox
AI

How we use AI

We think AI has a place in the world. Training on people's writing without asking isn't it.

  • We build cDox with AI

    Claude Code helps us write, test and review our code, so a small team can build carefully and fix things fast.

    Claude Code

  • Moving to Canadian AI

    We plan to bring Augure, a sovereign AI hosted in Canada, into how we build cDox.

    Augure

  • Your content stays out of it

    Nothing you write is read by AI, trained on, or sold to anyone who would. If we add AI features one day, they won't touch your content.

Companies we work with

What each one does for cDox, and what it can see.

FullHost Servers and backups
Everything stored in cDox
Montreal and Toronto
Helcim Card payments
Your card, typed straight into Helcim
Canada
Fathom Website visits
Anonymous page views on our public site, with no cookies
Canada
PostHog Product usage
Which features are used, never your documents
United States

The complete list of service providers is in our privacy policy.

Laws, standards and security

Canadian privacy law

cDox is run by BFH Labs, Inc., in Victoria, BC, and follows PIPEDA and BC's Personal Information Protection Act.

Data residency

Servers in Montreal and backups in Toronto help schools and public bodies with residency rules such as BC's FIPPA.

Breach notification

If a breach puts you at real risk, we'll tell you and the Privacy Commissioner of Canada, as the law requires.

Account security

Passwords hashed with bcrypt, API keys stored only as hashes, limits on sign-in attempts, and bot checks without an outside captcha.

Accessibility

We're working toward WCAG 2.1 AA: pages declare their language, colours meet contrast, and screen readers hear updates.

Certifications

cDox is not certified for SOC 2, ISO 27001 or HIPAA. If your work needs one of those, talk to us first.

What we don't allow

cDox is not a place for hate speech, harassment, threats or deliberate misinformation. An account used to create or spread them is closed, without warning.

Read our terms

Our technology

cDox is built on open source tools, many of them made by small teams like ours.

  • SvelteKit

    The web app and the API

    Open source

  • Tiptap and ProseMirror

    The editor in Pages

    Open source, made in Berlin

  • HyperFormula

    The formulas in Sheets

    Open source, made in Poland

  • Drizzle

    How cDox talks to its database

    Open source, made in Ukraine

  • Coolify

    Deploys cDox to our servers

    Open source, made in Hungary

  • Tauri

    The Mac, Windows and Linux apps

    Open source, run by a Dutch foundation

In the press

All coverage

Questions

No. Everything is encrypted on its way between you and our servers (HTTPS), but documents aren't encrypted on the server. That's what lets search, sharing, live editing and public links work. We don't read your pages, and only one person has access to the servers.
The one person with server access technically could. In practice, a document is opened only if you ask for help with it and give permission. No one else, and no AI, reads your work.
It's removed from cDox right away. The servers are backed up nightly and backups are kept 14 days, so a deleted page can live on in a backup for up to two weeks before it's gone for good.
Not on your content. Nothing reads, processes or trains on your documents, and we never sell them to anyone who would. We do build cDox with AI tools like Claude Code, which lets a very small team work quickly and reliably. If we add AI features one day, they will never touch your content.
Without an account, your documents are stored only on your phone and never reach our servers. The app still sends anonymous usage events, like which screens are opened, never your writing.
Yes. Your documents stay in Canada, under Canadian law. We aren't certified for SOC 2 or ISO 27001, so if your institution runs a privacy review, send us the questionnaire and we'll fill it in. cDox for Teams covers shared folders and billing by invoice.

Have more questions?

Contact us