Bloks. The Un-CRM.
PIPEDA Compliant Software Built for Canadian Financial Advisors
Twenty-two minutes into the review, your client mentions a separation and a new beneficiary. All of it is personal information under PIPEDA. The moment an AI tool touches it, your head office has a privacy file open.
Bloks is PIPEDA compliant software for financial advisors and insurance advisors working under Canadian privacy law. The PIPEDA-compliant platform captures meetings, builds client profiles and drafts compliance documentation. This page answers what your compliance team asks about PIPEDA compliance software: where personal information is stored, who reaches it, and whether it trains anyone’s model.
The law
What PIPEDA Compliance Means Inside a Canadian Advisory Practice
The Personal Information Protection and Electronic Documents Act governs how private-sector organizations in Canada handle personal information during commercial activities. Advisory practices sit squarely inside it. The Office of the Privacy Commissioner of Canada enforces it, and PIPEDA penalties reach $100,000 per violation.
Most PIPEDA compliance material addresses organizations in the abstract. Advisors meet privacy law somewhere specific: a client asking what the recorder is for, a compliance officer asking where the transcript lives, a compliance audit asking about a file from 2023. Our compliance guide for Canadian financial advisors covers the same PIPEDA requirements in more depth.
The Ten Fair Information Principles, in Plain Language
PIPEDA rests on ten fair information principles, and each one lands somewhere concrete in a practice. Accountability names a privacy officer. Identifying purposes explains why a recording exists. Limited collection keeps the tool on the meeting rather than the desktop.
The rest govern daily mechanics. Limiting use and retention sets how long a note survives. Accuracy keeps profiles current. Safeguards are the PIPEDA security controls underneath. Openness makes privacy policies readable. Individual access gives clients their file. Challenging compliance gives them a complaint route. Any PIPEDA compliance checklist you receive from head office restates these ten in questionnaire form.
PIPEDA-compliant software engineers for these principles. Everything else papers over them.
Accountability
Names a privacy officer
Identifying purposes
Why a recording exists
Consent
Meaningful, before it happens
Limited collection
On the meeting, not the desktop
Limiting use and retention
How long a note survives
Accuracy
Profiles stay current
Safeguards
The security controls underneath
Openness
Privacy policies people can read
Individual access
Clients get their file
Challenging compliance
A complaint route
Where Consent and Personal Information Actually Live in an Advisor’s Day
Consent under PIPEDA must be meaningful consent: the client understands the data collection and its purpose before it happens. That is a sentence at the top of a meeting, not a clause buried in a privacy notice signed two years ago. Express consent covers sensitive financial data. Implied consent covers ordinary administration. Consent management is the difference between the two being deliberate.
Personal information in advisory work runs deep. Income, health history behind an insurance application, family structure, beneficiary intentions. One annual review generates more sensitive data than most retail transactions produce in a year. PIPEDA compliance requirements for advisors therefore turn on storage and safeguards, not cookie banners and opt-out links.
Data residency
Canadian Data Residency: Your Client Data Stays in Canada
PIPEDA regulations do not explicitly require Canadian data residency. Ask a compliance officer at a Canadian MGA whether that settles it. Foreign servers trigger disclosure obligations, lawful-access exposure and a jurisdiction argument nobody wants mid-audit.
Bloks keeps client data hosted in Canada. Canadian data residency is the default here, not an enterprise upgrade, and it is why a firm answers the residency question in one sentence instead of a vendor questionnaire. Marc Gingras has written on why Canadian data sovereignty matters beyond any single platform.
Security review · head office
Answered
Data residency
Client data hosted in Canada
Canada
SOC 2 Type II
Independently audited
Attested
AI training
Never, and written into the DPA
In writing
Encryption
In transit and at rest, end to end
Encrypted
Consent
Captured per client, before the meeting
Flexible
Every answer comes with a document.
SOC 2 Type II Infrastructure, Independently Audited
SOC 2 Type II separates a security page from a security posture. Type I describes controls on one day. Type II proves the security controls operated across a monitored window, independently audited rather than self-declared. Security teams read it the way they read ISO 27001 and PCI DSS: an attestation somebody else signed.
Bloks is independently audited under SOC 2 Type II. Jean-Philippe Lespinasse, a cofounder, owns privacy and security, so the person answering your security questionnaires helped build what is being questioned. Our full security response documents the audit reports and subprocessors. Backup, disaster recovery procedures and incident response are covered there too, in the detail regulated industries expect.
Encryption, Access Controls and the Safeguards Behind Every Meeting Note
Safeguards are the seventh principle and the place vendor language goes soft. The concrete PIPEDA security controls behind every meeting note:
Encryption in transit and encrypted storage at rest, end to end
Role-based access, so an assistant licence sees only what an assistant should
Audit trails on every record, logged and traceable to the source meeting
Botless capture, so no third-party recorder joins the call or appears in the participant list
Retention policies set by the practice, never inherited from a vendor default
Breach detection and breach notification procedures documented in advance
That fourth line does real compliance work. A bot in the participant list is a fourth party. Clients notice.
Security questions
Security FAQ
See How Bloks Handles Canadian Data Residency
Every answer your compliance team needs, in one place. The FAQ covers data residency, certifications and access controls without a sales call.
AI training
Your Client Data Is Never Used to Train AI Models
Here is the question that stops adoption cold. If PIPEDA compliance software reads my client’s file, does that file end up inside somebody’s model? For most consumer AI products the answer runs to a paragraph. For Bloks it is one word. No.
Client data is never used for AI training. Not model training, not fine-tuning, not product research. The commitment is contractual, written into the data processing addendum your firm’s counsel reads before anything else on this page, alongside the vendor oversight and service providers language that PIPEDA accountability requires.
Bloks
A vendor who cannot answer the training question in one sentence is taking a paragraph for a reason.
Flexible Client Consent, Captured Before the Meeting Starts
Flexible client consent means the practice decides how consent is captured, because a Quebec insurance advisor and a cross-border portfolio manager face different client expectations. Some advisors announce recording verbally. Some collect express consent at onboarding. Some disable capture entirely for one relationship.
The software follows the practice. Withdraw consent works the same way: the client asks you to stop, the setting changes for that relationship, no support ticket, no privacy team escalation. The client decides. Our post on using AI without breaching confidentiality standards carries the script advisors use.
Retention Policies, Individual Access and Withdrawal Requests
Retention policies decide how long a recording, transcript and summary survive. Practices configure that window. Provincial regulators and dealer recordkeeping rules rarely agree on one number. Financial institutions frequently set a longer floor than PIPEDA itself.
Individual access is the principle behind the privacy requests you will eventually receive: a client asking what you hold on them, plus correction of anything wrong. PIPEDA gives them those individual rights and gives you roughly 30 days. Because every artifact traces to its source meeting, producing the file is a query, not an excavation. Our privacy policy sets out how personal information moves through the product.
Documentation
Compliance Software That Produces the Paperwork Instead of Demanding It
Most compliance software adds documentation work. It asks the advisor to log, tag, attest and file, then reports on how well they complied. The advisor absorbs the cost, one evening of paperwork at a time.
1
source meeting behind every KYP letter and compliance note
Documentation · drafted from the meeting
Live
HF
KYP letter, annual review
Harris family · From the March 12 meeting
Draft ready
SL
Meeting notes
Sara Lecavalier · Transcript and audio linked
Filed
MT
Consent record
Marcus Thorne · Captured before the call
Recorded
JT
Beneficiary change
Jonah Tremblay · Traceable to the source meeting
Audit trail
Bloks inverts that. The product generates compliance documentation from the conversation that already happened, so paperwork becomes an output of the meeting rather than a tax on it. No templates, no data collection forms.
KYP Letters and Compliance Documentation Traceable to the Source Meeting
KYP letters and suitability documentation are drafted from what was said. Know Your Product obligations require a record of the reasoning behind a recommendation, and that reasoning lives in the meeting, not in a form completed four days later from memory.
Every artifact links to its source meeting, transcript and audio behind it. Audit trails turn a note into a defensible record, the subject of our piece on audit-ready client meeting notes. Compliance audits stop being archaeology.
What Compliance Officers Ask Before Approving an AI Note Taker
Head office diligence follows a predictable order:
1
Where is the data stored, and under whose jurisdiction?
2
Which certifications exist, and were they independently audited?
3
Is client data used to train models, and is that in writing?
4
How is consent captured, and can it be withdrawn per client?
5
Who are the subprocessors, and what does the data processing agreement say?
Bloks answers all five with documents rather than assurance: the SOC 2 Type II report, the DPA, the security response, and a named security cofounder who takes the call. Firms running privacy management programs can map the answers straight into their records of processing activities.
Compliance review
Talk to us
Book a Compliance Review of Your Advisory Practice
Bring your compliance questions, not just your calendar. A cofounder walks your privacy team through residency, certifications and consent.
Before you start
Compliance Platform Questions Advisors and Head Office Ask
Is a US-hosted AI note taker compliant under Canadian privacy law?
It can be, but it creates disclosure obligations most practices would rather avoid. You must disclose it. Cross-border transfer means telling clients their personal information sits on foreign servers, reachable by foreign courts. A Canadian-hosted AI note taker for financial advisors removes the disclosure and the questions behind it.
Does PIPEDA require that client data stay in Canada?
No. The federal privacy law permits transfers outside Canada provided the organization stays accountable and discloses the practice. Provincial privacy laws, dealer policies and client expectations often set a higher bar than the statute, which is why data residency appears on questionnaires that never cite PIPEDA requirements at all.
What does a SOC 2 Type II report actually prove?
An independent auditor tested the security controls over months and found them operating as described. Type I is a snapshot. Type II is the footage. PIPEDA compliance solutions that claim a compliance posture without attestations behind it are selling you marketing.
How does Bloks handle Quebec’s Law 25 and provincial privacy laws?
Law 25, or Loi 25, raised consent, transparency and reporting requirements for Quebec organizations above the federal baseline. Bloks was built in Gatineau under it. Alberta and British Columbia apply PIPA to private-sector data protection, Ontario health providers apply PHIPA, and Alberta adds HIA for personal health information. Canadian data residency plus per-client consent satisfies the common denominator across all of them.
Can cross-border advisors meet SEC and FINRA expectations?
Yes. Practices serving clients on both sides of the border run under US supervision, and FINRA recordkeeping expectations sit alongside Canadian privacy requirements rather than replacing them. The audit trail, retention controls and risk assessments were designed for both. GDPR and CCPA obligations, where a practice carries them, rest on the same safeguards.
Built in Canada
A Privacy-First Un-CRM for Canadian Wealth and Insurance Advisors
Bloks serves wealth management practices, insurance advisors, portfolio managers and the MGAs and networks behind them, from Toronto to Vancouver to Montreal. SFL, Desjardins and Financial Horizons work with it. This privacy architecture was never bolted onto PIPEDA compliance software built for somebody else’s market. In 2026 Bloks was named one of Canada’s Top 100 AI Startups at ALL IN, and cofounder Marc Gingras joined Mila as Founder in Residence.
The AI meeting assistant built for advisors handles capture, documentation and follow-ups. Your compliance framework stays exactly where it is.
Zero Setup, Zero Data Entry, No New Compliance Risk for Your Practice
No fields. No forms. Nothing to configure before the first meeting, because the system feeds itself. That is the entire point of PIPEDA-compliant software that documents itself.
Fourteen days, every feature, no gating. Every plan includes every feature, identical in Canadian and US dollars, and assistants get their own secure licence rather than sharing yours.
Bloks
Every client, your only client.
Free trial · 14 days
Free trial
Start Your 14-Day Free Trial of Bloks
End-to-end encrypted. You own your data. Install Bloks before your next client meeting and see what gets captured.