Security at IXICA

IXICA has completed the Cloud Security Alliance (CSA) Consensus Assessments Initiative Questionnaire (CAIQ), which documents our security controls against the CSA Cloud Controls Matrix, and has published it to the CSA STAR Registry (opens in a new tab).

Our privacy program is designed to comply with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA). We have a designated Privacy Officer and documented practices for consent, safeguards, retention, access requests and breach reporting. Read our Privacy Policy, or contact our Privacy Officer at legal@ixica.com (subject line “Privacy”).

Our security program is aligned with the NIST Cybersecurity Framework (CSF) 2.0 (opens in a new tab) across its six functions: Govern, Identify, Protect, Detect, Respond and Recover. Alignment is confirmed through an annual internal self-assessment.

We have self-assessed our safeguards against the CIS Critical Security Controls v8.1 (opens in a new tab), Implementation Group 1 (IG1), the essential cyber hygiene baseline. It covers asset and software inventory, secure configuration, account and access management, vulnerability management, logging, backups and incident response.

We publish an Accessibility Conformance Report (ACR) based on the ITI VPAT® template (opens in a new tab). It describes how our customer-facing platforms conform to WCAG 2.2 Level AA, and where known gaps exist and how we plan to fix them. View our Accessibility Conformance Report. To give accessibility feedback or ask for the report in another format, contact support@ixica.com.

For U.S. healthcare customers, IXICA supports HIPAA obligations for services that store health information on our platform, such as virtual fax, voicemail and call recording. These services use administrative, physical and technical safeguards that follow the HIPAA Security Rule. Where IXICA acts as a business associate, we sign a Business Associate Agreement (BAA); please contact your account manager or support@ixica.com. Customers remain responsible for configuring these services in line with their own HIPAA obligations. See our Security FAQ for details.

For Ontario health care providers, IXICA supports custodians’ obligations under the Personal Health Information Protection Act, 2004 (PHIPA). Where we provide services that handle personal health information, we act on the custodian’s behalf, use that information only to provide the services, protect it with appropriate safeguards and notify the custodian of any privacy breach. Questions can be sent to our Privacy Officer at legal@ixica.com.