Security
How copilotBCprotects a record.
Stored in Toronto · Encrypted at rest · Enforced on the server
copilotBC holds student names, licence numbers, addresses and lesson history.
Every protection on this page is live today.
One record
Six stepsfrom curb to database.
What happens to a lesson after the instructor signs it off.
Sanitised
Typed
Input is stripped of HTML and control characters before it is stored. Offline, the record waits on the device and syncs later.
Encrypted
Sent
HTTPS only, enforced by a two-year HSTS header with subdomains and preload.
Identified
Checked
Your records need a signed-in account with a confirmed email. Sign-up, sign-in and password reset also need a valid App Check token.
Validated
Validated
The rules run on Google's servers. They check that the account owns the record, then check record type, status values, signature and consent shape, file size, and that nothing signed changes. Free text in your own records has no per-field length check.
Stored
Stored in Toronto
Records sit in Google Cloud Firestore, Toronto region (northamerica-northeast2). AES-256 at rest, TLS in transit. We keep no separate backups. Durability is Google Cloud's. Some services, such as email and card payments, run outside Canada. The privacy policy names each one.
Sealed
Locked
Once signed off, the lesson is locked in the database.
Isolation
Your students,and nobody else's.
Each instructor's data is keyed to their account. The one exception is a driving school you both agreed to work with.
Another instructor's account
We tried every path we found from a second account. All were denied.
An account with an unconfirmed email
Instructor, student and parent access all need a confirmed email. Google confirms Google sign-ins.
A script with no app token
Sign-up, sign-in and password reset fail without a valid App Check token. A forged token fails too.
The database, called directly
The rules run on the server, so a script meets the same checks as the app.
We test by attacking our own app, and re-test each fix.
Schools
If you teachfor a school.
On the School plan, one owner pays for several instructors. BC rules make the school keep records made under its licence, so the owner gets narrow access, with your consent.
Consent
Both sides agree
The owner sends a join link. You sign in, read what the school will see, and accept. Only your own session, with a confirmed email matching the invite, can activate a seat.
Access
Read-only
An owner can invite or remove you, and change nothing in your account.
Never shown
Hidden from owners
Your saved signature, e-transfer address, AI feature choice, payout set-up, and activity log entries about your sign-in security.
Shown
Your driver's licence number
The school must record its instructors, so the owner sees it. It never appears on a record, a report or anything a student sees.
Shown
Everything, while the seat is live
Including students, lessons and reports from before you joined. The accept screen says so.
After
School records stay with the school
Records made during a seat carry a school stamp nobody can change. The school keeps read access to them after the seat ends.
Day to day
Day to day.
Device
Audio needs consent
Recording must be allowed (by the school, if there is one), switched on by the instructor, and agreed to by the student in a signed consent. A no is final.
Device
Audio stays on the device
Transcription runs in the browser. Audio is never uploaded. Recordings delete after 1 to 90 days, 30 by default, with no keep-forever option.
Device
A student can withdraw
Any time, from their portal. The audio is deleted next time the instructor opens the app. Written notes stay on the training record.
Device
Sign-out clears the device
You stay signed in until you sign out. Sign-out wipes saved settings, your licence details, cached audio and the offline database, and stops notifications to that device.
Device
Unsynced work is kept
If a record has not reached the server, sign-out warns you and asks first.
Signing in
Two-step, with an authenticator app
Optional, in Settings under Account and access. Each sign-in asks for a six-digit code, so a stolen password alone does not get in.
Signing in
No text codes, no trusted devices
Phone numbers can be hijacked, so codes never go by text. A signed-out device is always asked again. Google and Apple accounts can add the authenticator app too.
Signing in
Recovery codes, shown once
Ten single-use codes, salted and hashed. You confirm one before leaving the screen. A code still needs the password. Guessing is rate-limited, and each recovery is emailed and logged.
Payments
Cards never reach us
Payment happens on a Stripe-hosted page (PCI DSS SAQ-A). No card form loads in copilotBC. Only our payment server marks a card payment paid, after Stripe confirms it.
Privacy
Only what the job needs
We collect what a BC instructor needs to teach and keep the regulatory record.
Privacy
Rights, built in
Export one student's full record. Corrections go on an append-only trail. Retention matches the regulatory window.
Plan
Ending a plan deletes nothing
App access ends. Records stay, signed records stay retained, and resubscribing restores everything.
Signatures and the browser
Signaturesand the browser.
Signatures
Two people, one device
An electronic signature under BC's Electronic Transactions Act, s.11. The instructor signs and hands over the device. The student types their name and ticks the consent boxes while the instructor watches.
Signatures
Scan to sign, once
Signing on the student's phone uses a 192-bit random token. It works once, and expires within 10 minutes to 24 hours.
Browser
A strict Content-Security-Policy
An allow-list of every script, style, font, image and network destination. No inline scripts, no plugins, no framing.
Browser
Defensive headers
X-Frame-Options: DENY, X-Content-Type-Options: nosniff, a strict Referrer-Policy and a locked-down Permissions-Policy.
Injection
Three layers
Input is cleaned, server rules check each write, and text renders escaped, with no eval and no dangerouslySetInnerHTML.
Injection
Dependencies, audited
Packages are checked for published vulnerabilities, and advisories that affect browser code are patched.
Permanence
Signed recordsstay as signed.
The database itself stops a signed record changing.
BC's Motor Vehicle Act Regulations, Division 27, require six years of training records.
A signed lesson cannot be un-signed, and its status cannot be rolled back.
The account holder cannot delete a finished lesson, signed or not.
A taught student cannot be deleted. Their records stay.
A correction is a dated addendum. The original text stays.
Key actions are logged. Logged entries cannot be edited.
Related pages.
- Parents and students
- Your driver's name, licence details and progress are stored in Canada. Your instructor and their driving school can see them, and so can copilotBC support during a support task. Signed records cannot be changed.
- Instructors
- Signed records cannot be changed, and sign-out clears the device.
- Regulators
- copilotBC is built around MVAR Division 27 retention, the Electronic Transactions Act signature model and PIPA.
Questions go to the privacy contact. [email protected]