Security
Where your data is, who can access it, and what happens when something goes wrong.
It is the first question a Québec buyer asks, and it deserves a precise answer rather than a page of compliance logos.
Where
- Your 3CX system runs on a virtual server dedicated to your business, in a data centre in Beauharnois, Québec. No other client has access to it.
- Your recordings and voicemails stay on that server, then are archived daily to dedicated backup storage, in Canada, over an encrypted transfer.
- Nothing is hosted in the United States or anywhere else. Calls travel over our Canadian carriers.
Who has access
- Our technical team, through named accounts protected by two-factor authentication.
- You, through the portal and the 3CX apps, with the roles you define (management, billing, technical, HR).
- Nobody else. We do not sell, share or analyze your data for any third party. AI features (IQ Center, the 3CX AI suite) are enabled only if you choose them.
Retention
You choose how long recordings and call logs are kept. The usual value is one year; longer, or indefinite, retention is possible.
At the end of the agreement, your data is handed back to you, then erased.
What protects your system
Measure by measure
| Measure | Detail |
|---|---|
| Encryption in transit | TLS certificate on every server, renewed automatically and monitored (alert at 21 days, red at 7) — with a check that the certificate being served is indeed the new one |
| Intrusion blocking | Intrusion attempts detected on one server are blocked across our entire fleet |
| Firewall | Only the required ports are open; administration is restricted to our addresses |
| Backups | Daily, off-site, in Canada |
| Monitoring | Agent on every server: health, certificate, licence, trunk quality, backups |
| Updates | 3CX and system patches applied by our team |
| Disaster recovery | Server rebuilt from the latest backup, included in the plan |
What we do not claim
We do not publish any certification or attestation of compliance with Québec's Law 25 that we do not hold. What we do: hosting in Canada, named access, encryption, retention defined by you, hand-back and erasure at the end of the agreement. If your organization has a security questionnaire, send it to us: a technician answers it in writing, point by point.
A specific question about security?
Write to info@uc365.ca. A technician, not a salesperson, answers you.