athomHow Fathom handles your data.
Fathom handles regulated personal information for plan members in every Canadian province. Here is exactly how we protect it, including what is built today and what is still on the way.
Tenant isolation
Each brokerage is an isolated tenant. Data access is scoped to your tenant on every path, backed by a fail-fast guard that throws on any unscoped query. Your documents, clients, employee records and named rates are never visible to another brokerage on the platform.
The shared engine
One deliberate exception, and it is narrow. Anonymised rate observations — carrier, region, industry, size, premium, rate movement — pool across the platform so benchmarks mean something on day one rather than after a year of collecting. Individual records never cross. The crossing is a column allowlist on a single table, enforced by the same guard, and every other model stays sealed.
Encryption
TLS in transit. Data is encrypted at rest by our infrastructure providers under their platform defaults. Connected-mailbox credentials are additionally application-encrypted with AES-256-GCM. Per-tenant key isolation (KMS-backed) is on the near-term roadmap.
Tamper-evident audit log
Every regulated action is recorded to an audit log where each entry is SHA-256 hash-chained to the one before it, per tenant. Any alteration or deletion of history is detectable, and chain verification is built in.
Authentication
Bcrypt password hashing and signed, httpOnly cookie sessions. Logout and password reset revoke live sessions server-side, so a sign-out actually ends access.
Broker-in-the-loop on regulated actions
The agent drafts; the licensed broker reviews and authorizes. Carrier submissions, client communications, and benefit-change confirmations all require human sign-off. By design and by regulation.
Data residency
The database and application run in Toronto, Canada (DigitalOcean, tor1) — clients, employees, reviews, quotes and the audit log are stored in-country. Two things sit outside: uploaded documents in Cloudflare R2 object storage, and model inference by Anthropic in the US under a no-training commitment.
Compliance posture
- Hardened intakeThe public funnel enforces per-IP rate limiting, a file-type allowlist with magic-byte content sniffing, and safe content-type/disposition on every download.
- PIPEDAWe operate as the data processor under your broker tenant's authority; you are the controller. DPA available on request.
- Breach + incident processStanding incident-response runbook; we notify the affected tenant first, then assist with the Privacy Commissioner notice under PIPEDA.
- SOC 2Not yet certified. We build to its trust-services criteria (access control, tamper-evident audit, encryption, change management) and will pursue formal certification as we scale. We will not claim a certification we do not hold.
- On the roadmapField-level encryption of the most sensitive fields (DOB, claims, salary), Postgres row-level security, Canadian-region data residency, and point-in-time recovery / off-site backups.
- SubprocessorsAnthropic (model inference, US, no training on customer data per their commercial terms), our Postgres host (DigitalOcean, Toronto/tor1), object storage (Cloudflare R2), Stripe (billing), and Microsoft/Google (only for a connected mailbox).