Security and privacy
Last updated October 19, 2026
In short: your card is handled by Stripe and never touches our servers. Every page is encrypted. Your documents are kept in private storage, behind links that only you receive and that expire. We collect only what we need to fill your order, and we never sell it.
PCI DSS Level 1 paymentsProcessed by Stripe, certified to the highest level of the card industry's security standard.
We never see your cardYou pay on Stripe's secure page. We never receive, see or store your card number.
Encrypted in transitEvery page, search and download uses HTTPS (TLS) encryption.
Private, expiring linksYour documents are stored privately. Download links are unique to your order and expire after an hour.
Canadian privacy lawWe follow PIPEDA: we collect the minimum, keep it only as long as needed, and never sell it.
Unaltered official documentsThe PDF you get is exactly what the Ontario Business Registry issues, with its transaction number.
Payments
- All payments are processed by Stripe, a payment processor certified as a PCI DSS Level 1 Service Provider, the most stringent level of certification in the payment card industry.
- You enter your card on Stripe's own checkout page. Your card number goes directly to Stripe. CorpReport never receives, sees or stores it.
- We receive only confirmation that you paid, the amount, and the email address you used.
Your documents
- Documents are kept in private cloud storage that is encrypted at rest and is not publicly accessible.
- Your order page is reachable only through a link containing a long secret code, sent to you. Download links generated from it expire after one hour.
- We order only the exact Ontario Corporation Number you confirm before paying, and we check the registry's name against it.
- Documents are deleted from our storage after two years. Keep your own copy with your corporate records.
Your information
- We collect what we need to fill your order: the corporation you searched for, your email address, and basic technical information (such as your IP address and approximate city) used to prevent fraud and abuse.
- IP addresses are erased after 12 months. Search logs are deleted after two years.
- We never sell your information or share it for advertising. We share it only with the service providers that run CorpReport (payments, email, hosting and storage), and only as needed to provide the service.
- The details on a Profile Report or Certificate of Status are public records held by the Government of Ontario.
- See our Privacy Policy for the full details and your rights.
The website
- All traffic is encrypted with HTTPS, and browsers are told to always use a secure connection (HSTS).
- Access to our systems is limited to the people who run the service, protected by strong passwords and limited login attempts.
- Every order is logged, so any problem can be traced and fixed.
Report a concern
If you think something is wrong with your order, or you've found a security issue, email [email protected]. A person reads every message.
CorpReport is an independent service operated by forMaD Health Inc., an Ontario corporation. It is not affiliated with or endorsed by the Government of Ontario, ServiceOntario, or any professional regulatory College.