Security, privacy and where your data lives
This page states what is true today. Where something is planned rather than built, it says so. Meravor holds no third-party security certification — no SOC 2, no ISO 27001, no published penetration test — and we will not imply otherwise.
Where the data is
- Canada. Records are stored and processed in Google Cloud's Montréal region.
- Built for Law 25 and PIPEDA, Quebec's and Canada's privacy regimes.
- A printable attestation covering data residency and security is available inside the professional dashboard, for a partner's own due diligence.
How it is protected
- AES-256-GCM field-level encryption at rest for sensitive free text.
- PBKDF2-SHA256 password hashing, salted. Passwords are never stored recoverably.
- Encrypted in transit, with HSTS and a strict Content-Security-Policy that permits no inline scripts.
- Mandatory two-step verification on every professional account.
Who can see what
- Default-deny. A professional sees the planning view and nothing else until the family grants a tier by name.
- Tiered, revocable grants. Access locations, health details, digital accounts and final wishes are each granted separately and can each be withdrawn.
- Partners see engagement, never contents. Invited, started, activated, successor named, review due — and nothing about assets, balances, beneficiaries or instructions.
- No file storage. Meravor records where things are kept. It does not hold the documents themselves, so there is no document store to breach.
If you stop paying, or leave
- Export, always. A full export plus a printable Emergency Binder, at any time.
- Self-serve deletion with a 30-day window and a restore link before the purge runs.
- 30-day money-back guarantee on any paid purchase.
Meravor is run by a real Canadian company, not a passing app. But if we ever had to wind down, we would give at least 90 days written notice, keep exports working the entire time, and — before shutting anything off — email every account a copy of their own printable binder, so the record survives us. Your family's information is yours; our ending does not take it with us.
Who runs it
Meravor is operated by Purefox Holdings Ltd., a company registered in Alberta, Canada. Google Cloud Platform is the hosting and database subprocessor; Stripe processes payments; Resend delivers transactional email. Questions about any of this reach a person, not a queue.
This page is general information about the service, not legal, tax, financial or insurance advice. Meravor is not a law firm. Meravor is operated by Purefox Holdings Ltd., a company registered in Alberta, Canada — PO Box 88044, RPO Walden, Calgary, AB T2X 4V6. Email reaches us directly at help@meravor.ca, and we answer within one business day.