FairPays brand emblem
FairPaysREGULATED
Information Governance
gavelFINTRAC / FinCEN Regulated
PIPEDA & FINTRAC STATUTORY CLEARING STANDARDS

Data Policy & Information Governance

Effective Date: July 22, 2026 • Operating Entity: FairPays Inc. / P2PHub Institutional Infrastructure

Statutory collection, cryptographic storage, and lifecycle archival of telemetry across bilateral Canadian and US peer corridors. Governed under federal financial intelligence standards.

verifiedCanada & USA Cross-Border Rails
100% Custodial Trust Enforced
Statutory MandatePCMLTFA & Bank Secrecy Act
Storage CryptographyAES-256-GCM / HSM
verified_user
Canada Regulatory ID#M21048892
shield
USA Regulatory ID#310002488912
Terms Privacy
search11 Articles
verified_user Regulatory Guardrails
Tier 1 Custodial
Statutory Retention7 YearsPCMLTFA s.68 Mandate
Data MonetizationSTRICT 0%Never Sold or Brokered
Vault CryptographyAES-256-GCMTLS 1.3 Strict Ciphers
Clearing ProtocolCustodial Rails100% Wallet Protected

Our enterprise data governance framework enforces an automated, auditable end-to-end lifecycle across four distinct continuous phases:

input
1. Collection & IngestionStatutory KYC/CIP ingestion, strict telemetry boundary gating, and origin-authenticated bilateral counterparty validation.
token
2. Cryptographic Storage & TokenizationImmediate envelope encryption with field-level tokenization prior to persistence in multi-region ledger partitions.
autorenew
3. Active Custodial ProcessingDual-custody verification, bilateral corridor clearing reconciliation, and automated AML anomaly screening.
auto_delete
4. Retention & Certified PurgingWORM audit preservation through statutory limits followed by cryptographic shredding and hardware-level purging.

Every data element processed across Canadian and US corridors is categorized into a mandatory 4-tier security classification:

lockTier 1: Restricted Data
RESTRICTED

Government Photo IDs, Passports, Biometric scans, SIN / SSN records, and raw bank transit credentials. Subject to HSM-backed field encryption.

shieldTier 2: Confidential Data
CONFIDENTIAL

Bilateral custodial balances, Interac & Zelle settlement identifiers, transaction histories, AML risk scores, and customer case dockets.

dnsTier 3: Internal Operational
INTERNAL

System telemetry, TLS cipher handshakes, latency benchmarks, anonymized liquidity metrics, and routing health indicators.

publicTier 4: Public Information
PUBLIC

Published mid-market CAD/USD exchange indices, legal governance charters, public API documentation, and regulatory registration numbers.

Strict statutory retention periods enforced by automated lifecycle pruning:

AML & FINTRAC Audit Trail7 Full Years
PCMLTFA Regulations s.68WORM Vault
KYC & Identity VerificationTenure + 5 Yrs
FinCEN CDD Rule (31 CFR)AES-256 Cloud
Session & Security Telemetry180 Rolling Days
SOC 2 Type II BaselineRotating Logs
Dispute & Custodial Mediation7 Years
Commercial Arbitration CodeCold Encrypted

For data privacy inquiries, statutory compliance requests, or regulatory escalations:

Data Protection Officer[email protected]
Compliance Secretariat[email protected]
mailEmail
Corporate HeadquartersFairPays Inc. / P2PHub Institutional InfrastructureToronto, Ontario, Canada • www.fairpays.ca
verified_user

Registered Financial Entity & Custodial Safeguards

FairPays Inc. operates under statutory financial registrations with FINTRAC (Canada Registration #M21048892) and FinCEN (USA Registration #310002488912). Bilateral custodial exchange accounts are segregated and held with Schedule I chartered Canadian banks and FDIC-insured US depository partners. 100% Custodial Trust Enforced.

FINTRAC REGISTRATION#M21048892
FinCEN REGISTRATION#310002488912
check_circle 100% Wallet Protected check_circle SOC 2 Type II check_circle AES-256 Storage
TermsPrivacyData policySecuritySupported corridorsDelete account

© 2026 FairPays Inc. • P2PHub Institutional Infrastructure. All rights reserved.

FairPays stylized monogram F with peer-to-peer exchange arrows in vibrant teal and emerald green, modern fintech icon mark. Design context: - Primary color: #0a2540 - Font: manrope - Mode: light - Roundness: rounded-md.
FairPaysInstitutional Governance
FairPays Protocol/Statutory Governance/Institutional Data Policy
FINTRAC & FinCEN STATUTORY CLEARING STANDARDS

Data Policy & Information Governance

Effective Date: July 22, 2026 • Operating Entity: FairPays Inc. / P2PHub Institutional Infrastructure

This Data Policy governs the acquisition, processing, custodial segregation, cryptographic storage, and lifecycle archival of telemetry, account credentials, and transaction ledgers within FairPays peer-to-peer exchange corridors. All clearing activities operate strictly under Canadian and United States supervisory baselines.

verifiedFINTRAC Registered Institution: M21048892
account_balanceFinCEN Registered Financial Entity: 310002488912
shieldPIPEDA & Dual GDPR Baseline
account_balanceJurisdiction & Supervision
ACTIVE REGISTRATION
Primary Sovereignty:Canada & USA Cross-Border
Statutory Mandate:PCMLTFA & Bank Secrecy Act
Security Protocol:AES-256-GCM / Hardware HSM
Settlement Safeguards:lockCustodial Trust Enforced
infoCAD cleared via Interac e-Transfer; USD cleared via Zelle & FDIC depository networks.
search
11 Codified Articles
ARTICLE 01

Scope & Platform Coverage

policy

This Data Policy establishes the regulatory framework governing the collection, custodial safeguards, ledger verification, and international processing of information for users accessing FairPays peer-to-peer foreign exchange and institutional settlement rails.

badgeAccount & Identity Verification

Statutory customer due diligence (CDD) under PCMLTFA Schedule 1 guidelines and FinCEN Beneficial Ownership registry standards.

account_balance_walletWallet Balances & Ledgers

Real-time ledger updates, fiat top-ups, institutional multi-currency vault allocations, and internal double-entry bookkeeping.

currency_exchangeP2P Bids & Currency Transfers

Matched bilateral order books, rate locks, and protected settlements cleared via Interac e-Transfer (CAD) and Zelle (USD).

gavelAML / CTF Regulatory Auditing

Continuous screening against OFAC, OSFI, and international sanction lists with zero tolerance for illicit transaction routing.

ARTICLE 02

Data Classification & Lifecycle Management

dataset

To maintain end-to-end institutional data management and governance across bilateral CAD/USD exchange corridors, FairPays enforces a strict four-tier Data Classification Scheme governed by formal security baselines:

1. Restricted Data

HIGHEST ISOLATION

Biometric templates, government identity credentials (passports, driver licences), SSN/SIN tax identifiers, bank routing credentials, and Interac/Zelle linked deposit accounts.

• Dual-Custody HSM Keys• Envelope Encryption• Air-gapped Vaulting

2. Confidential Data

CONTROLLED ACCESS

Matched peer order transactions, corridor settlement ledgers (CAD ⇄ USD), user vault balances, dispute resolution transcripts, and anti-fraud AML screening logs.

• RBAC Authorization• Ephemeral Tokens• SOC 2 Type II Logging

3. Internal Data

OPERATIONAL USE

Technical device telemetry, IPv4/IPv6 access networks, user-agent telemetry, mutual TLS (mTLS) session parameters, and continuous health telemetry.

• 180-Day Rolling Horizon• Pseudonymized• Rotating Log Rings

4. Public Data

FREELY AVAILABLE

Published foreign exchange benchmark rates, regulatory compliance disclosures, statutory policies, supervisory registrations (FINTRAC/FinCEN), and public key infrastructure certificates.

• CDN Edge Cached• Cryptographic Integrity Verified
ARTICLE 03

Purposes of Processing

checklist_rtl

Processing of data elements is restricted to necessary operational functions and regulatory mandates:

swap_horizontal_circleExecute & Settle Transfers

Facilitating peer orders, verifying counterpart release triggers, and updating protected multi-currency wallet reserves.

account_balanceReconcile Ledgers

Reconciling internal custodial ledgers with Canadian Schedule I banking rails and US partner depository institutions.

verified_userAML & Sanctions Compliance

Conducting automated suspicious activity assessments, PEP screening, and Large Virtual Currency / Cash Reports.

shieldMulti-Factor & Device Security

Enforcing biometric device challenges, OTP verifications, session anomaly checks, and wallet protection safeguards.

monitoringPerformance & High Availability

Benchmarking transaction throughput, reducing order latency, and ensuring fault-tolerant server redundancy.

descriptionStatutory Regulatory Filings

Responding to formal subpoenas, regulatory inquiries, and mandatory compliance examinations from oversight agencies.

ARTICLE 04

Legal & Operational Bases

balance

All data processing operations are anchored in explicit legal predicates recognized under Canadian federal privacy statutes (PIPEDA) and international equivalents:

Contractual Necessity

Required to execute peer orders, release locked currency amounts, and manage user wallet repositories pursuant to User Terms.

Statutory Obligation

Fulfilling PCMLTFA (Canada) and Bank Secrecy Act (USA) reporting thresholds, FINTRAC inquiries, and federal tax disclosures.

Legitimate Security

Preserving wallet integrity, detecting botnets, preventing account takeovers, and auditing internal custodian infrastructure.

ARTICLE 05

Data Retention Schedules & Destruction Standards

hourglass_bottom

FairPays maintains rigorous statutory retention schedules aligned with Canadian PCMLTFA and US FinCEN requirements. Once legal retention thresholds expire, records undergo certified data destruction protocols:

Data DomainStatutory Retention PeriodRegulatory MandateDestruction Standard
AML & FINTRAC Audit Records7 Full Calendar YearsPCMLTFA Regulations s.68Cryptographic Erasure / DoD 5220.22-M
KYC Customer Due DiligenceTenure + 5 Years Post-ClosureFinCEN CDD Rule (31 CFR)NIST SP 800-88 Rev 1 Cryptographic Purge
Session, Auth & Telemetry Logs180 Rolling DaysSOC 2 Type II Security StandardAutomated Key Destruction & Ring Zeroing
Dispute & Settlement Archives7 Years From SettlementPIPEDA & Commercial CodesNIST SP 800-88 Media Sanitization Protocol
verifiedCertified Media Sanitization & Key Revocation Protocol

Upon expiration of mandatory retention terms, FairPays utilizes multi-pass Cryptographic Erasure (CE) whereby data encryption keys (DEKs) and key-encrypting keys (KEKs) in hardware security modules are destroyed, rendering ciphertext mathematically irrecoverable across all physical storage arrays. Media decommissioning complies with NIST SP 800-88 Rev 1 and DoD 5220.22-M guidelines.

ARTICLE 06

Sharing & Authorized Processors

hub

Personal data is never monetized. Disclosure occurs strictly under institutional data processing agreements with qualified counterparties:

account_balancePayment Processors & Domestic Banks

Cleared clearinghouses and Schedule I Canadian banking entities, facilitating Interac e-Transfer settlements and US Zelle transfers.

fingerprintIdentity & Fraud Prevention Partners

Accredited biometric verification nodes and real-time OFAC/PEP watchlist screening algorithms under strict confidentiality binds.

cloud_doneCloud Infrastructure & SOC 2 Hosts

Certified hyper-scale data centres located in North America with audited SOC 2 Type II controls and hardware encryption.

gavelRegulators & Law Enforcement

Formal supervisory compliance dispatches executed only upon valid legal warrants or statutory PCMLTFA production orders.

verified
We Never Sell Your Personal Data

FairPays has never commercialized, rented, or leased customer identity, financial records, or behavioral metrics to ad networks, data brokers, or third-party marketers. Zero exceptions.

ARTICLE 07

Cross-Border Transfers & Safeguards

public

Because FairPays powers bilateral peer-to-peer exchanges between Canadian Dollar (CAD) and United States Dollar (USD) rails, data transmissions span international borders in compliance with standard contractual protections:

Standard Contractual Safeguards (SCCs)
BILATERAL RAILS

Cross-border financial routing adheres to Standard Contractual Clauses (SCCs) and US-Canada adequacy standards, guaranteeing that data originating in Ontario, Quebec, or any Canadian province receives uniform constitutional and statutory privacy shielding when processed across US partner networks.

View North American Corridorsarrow_forward
ARTICLE 08

Encryption, Zero Trust Architecture & Access Controls

lock

FairPays operates under an institutional Zero Trust Architecture and strict least-privilege operational model, guaranteeing continuous authentication, robust cryptographic isolation, and zero implicit trust:

key
AES-256-GCM & FIPS 140-2 Level 3 HSM

All database records, vault allocations, and credentials are encrypted at rest using AES-256-GCM. Cryptographic keys are protected inside dedicated FIPS 140-2 Level 3 Hardware Security Modules (HSMs) with automated rotation.

https
TLS 1.3 & Mutual TLS (mTLS)

Transport layers mandate TLS 1.3 with Perfect Forward Secrecy (PFS) for external endpoints. All internal microservices communicate exclusively via authenticated mutual TLS (mTLS) with strict micro-segmentation.

shield
Zero Trust Continuous Verification

Zero implicit trust for any actor, service, or network boundary. Every transaction request undergoes continuous cryptographic validation, hardware FIDO2 challenges, and adaptive anomaly scoring.

admin_panel_settings
Least-Privilege RBAC & Ephemeral Access

Role-Based Access Control (RBAC) eliminates standing administrative privileges. Technical personnel utilize short-lived, time-bound ephemeral credentials that expire immediately upon task completion.

group_work
Dual-Custody Multi-Party Authorization

Sensitive custodial vault adjustments, system parameters, and policy changes strictly require multi-party dual-custody authorizations with independent cryptographic signatures before execution.

verified_user
PIPEDA, FINTRAC & SOC 2 Type II

Fully compliant with Canadian PIPEDA statutory principles, FINTRAC/FinCEN compliance baselines, and certified against annual SOC 2 Type II trust security criteria.

ARTICLE 09

Your Rights & Automated Data Requests

manage_accounts

Under Canadian PIPEDA principles and applicable state laws, users hold clearly defined rights concerning their records. Where statutory AML rules require retention, certain deletion rights are limited to account disactivation while maintaining the mandatory 7-year audit file.

1. Right to Access & Portability

Request a complete JSON/CSV export of your verified exchange history, ledger debits, and identity verification logs.

2. Right to Rectification

Submit documentary evidence to rectify outdated residential addresses, legal name changes, or banking handles.

3. Right to Restriction

Restrict non-essential data processing or withdraw discretionary communications at any time.

4. Account Erasure Request

Submit an automated erasure request. Records not subject to statutory AML rules are permanently purged within 30 days.

Submit Subject Access or Erasure Request

Processed automatically by our Data Protection Office within statutory timeframes.

verifiedOpen DPO Ticket
ARTICLE 10

Policy Amendments & Regulatory Revisions

history_toggle_drop_down

FairPays reviews this Data Policy on a continuous basis to reflect changes in regulatory directives from FINTRAC, FinCEN, provincial privacy commissioners, or changes in clearing infrastructure. Material updates are communicated at least 30 calendar days in advance via platform notifications and email dispatch. Continued usage of FairPays services after effective dates confirms acknowledgement of revised terms.

ARTICLE 11

Contact DPO & Regulatory Escalation

contact_support

Direct inquiries, formal regulatory correspondence, or supervisory audits may be submitted directly to our compliance officers:

Data Protection Officer

Response window: 24 business hours

Compliance Secretariat

FINTRAC & FinCEN liaison

Corporate Headquarters
FairPays Inc.

Bay Street Financial District, Toronto, ON, Canada