Law 25: entrusting your invoices to Scanee

In brief

• A vendor invoice often holds personal information: a freelancer’s name and address, banking details, a signature. Quebec’s law then governs how you hand it over to a tool.
• Scanee acts as a service provider: it processes your documents on your behalf, to deliver the service, and for nothing else. You remain responsible for the information.
• The files and data of your documents are hosted in Canada. AI processing takes place at Google, in the United States. That is a communication outside Quebec, which calls for a privacy impact assessment (PIA) and a written agreement.
• Section 5 gives you Scanee’s answers to PIA questions, in a table.
• You set retention per project, you keep a record of every change, and you can archive your files in your own storage.

1. Your invoices hold personal information

Personal information is any information about a natural person that allows them to be identified. A business-to-business invoice doesn’t always contain any. But a stack of invoices, receipts and statements often includes:

• the name, address and phone number of a freelancer or subcontractor;
• banking details or a void cheque;
• a signature;
• an employee’s name on an expense report or a receipt;
• the name and address of an individual customer.

As soon as a document holds this kind of information, Quebec’s Act respecting the protection of personal information in the private sector, modernized by Law 25, governs how your business collects, uses, communicates, keeps and destroys it. Handing these documents to an extraction tool is a communication to a service provider.

If you also operate elsewhere in Canada, the federal law (PIPEDA) may apply. This document covers the Quebec law.

2. What the law requires of you

The obligations that apply when you entrust invoices to a provider such as Scanee:

3. Scanee’s role: a provider processing on your behalf

In your relationship with Scanee, your business holds the information and is responsible for it. Scanee, a product of Skillztank Inc., is the service provider you entrust with a task: receiving your documents, extracting their data, displaying it for review and exporting it according to your settings.

Section 18.3 allows you to communicate personal information to a provider without the consent of the people concerned, when it is necessary to carry out the service contract, on three conditions: a written contract; confidentiality protection measures set out in the contract; use limited to carrying out the contract, with no retention after it expires. The provider must also notify your person in charge, without delay, of any breach or attempted breach of confidentiality, and allow them to carry out any verification on the matter.

What Scanee does, in practice:

Scanee itself relies on vendors to deliver the service: Google (hosting, user sign-in and AI), MongoDB Atlas (database), Amazon Web Services (email) and Stripe (subscription billing). The list, with each vendor’s role and location, is in the security and privacy overview.

4. Processing outside Quebec

What happens. The files and data of your documents are hosted in Canada; the application servers are in Google Cloud’s Montréal region. To extract the data, Scanee sends each document to Google’s AI services (Gemini), which process it in the United States, then saves the result in Canada. Google keeps prompts and responses for 55 days, solely to detect abuse, and does not use them to train its models. If a project turns on full-text reading, the document is also read by Google Cloud Vision, whose processing location is not guaranteed to be in Canada.

Two other communications outside Quebec belong in your assessment: your users’ sign-in accounts (name, email address), managed by a global Google service that does not host them in Canada, and conversations with the AI assistant, whose thread Google keeps so that questions can follow on from each other.

What it means. Under section 17, before communicating personal information outside Quebec, or entrusting someone outside Quebec with using or keeping it on your behalf, you must carry out a PIA. It takes into account, among other things, four factors:

The communication may take place if the assessment shows that the information would receive adequate protection, in particular in light of generally recognized principles of personal information protection. It must then be covered by a written agreement that takes into account the results of the assessment and, where applicable, the terms agreed to mitigate the risks.

What you can do to reduce the risk.

• Define, in each project, only the fields you need.
• Turn on automatic deletion, in “files only” or “purge everything” mode, with a period that matches your policy.
• Archive files in your own storage, wherever you choose. AI processing still takes place in the United States; only where the files are kept changes.
• Keep more sensitive documents, such as employee expense reports, in a project with restricted access.

Scanee cannot carry out this assessment for you or tell you whether it is conclusive. Our role is to give you accurate answers.

5. Ready answers for your PIA

6. Individuals’ rights

A person can ask whether you hold information about them, get a copy of it and ask for it to be corrected (sections 27 and 28). Computerized information collected from them is, at their request, provided in a structured, commonly used technological format, unless that raises serious practical difficulties. You respond in writing within 30 days of receiving the request (section 32).

Your business receives the request and responds to it. In Scanee, you can:

• find the documents about that person, project by project: with a text search (title, summary, extracted text, displayed columns) or a search by meaning;
• correct an extracted field, with the change recorded in the log;
• export the data to CSV or Excel;
• delete documents that no longer need to be kept, or let the automatic deletion rule handle it.

Deleting a document by hand removes its record and its data from your projects, but the original file stays stored until the project is deleted, and the log keeps a copy of the document’s data. For complete erasure, use automatic deletion in “Purge everything” mode.

7. Retention and destruction

The law requires you to destroy or anonymize personal information once the purposes for which it was collected are met, subject to retention periods set by law (section 23). For accounting records, tax laws often require you to keep them for several years. Set your retention period with your accountant or advisor.

In Scanee, the rule is set per project, in the “Storage” tab, “Data Retention & Privacy” section:

Two ways to reconcile tax obligations and minimization:

• Keep the records on your side, not in Scanee. Archive files in your own storage or attach the PDF to the entry in your ERP, then set a short deletion period in Scanee.
• Keep the data, not the files. “Files only” mode deletes the source document and keeps the extracted data for your reports.

8. Confidentiality incidents

A confidentiality incident is access, use or communication not authorized by law, or the loss of personal information (section 3.6). If you have reason to believe an incident has occurred, you must take reasonable measures to reduce the risk of injury (section 3.5). If the incident presents a risk of serious injury, you must promptly notify the Commission d’accès à l’information and the people concerned. To assess that risk, you consider in particular the sensitivity of the information, the anticipated consequences and the likelihood of harmful use (section 3.7). You keep a register of all incidents (section 3.8).

If the incident occurs at your provider, section 18.3 requires it to notify your person in charge without delay.

To report an issue or ask a question, write to support@scanee.ai.

9. Going further

Scanee’s security and privacy overview sums up hosting, AI processing, isolation, encryption, roles, retention and vendors. The full security brief details each point and answers security questionnaires: it is sent on request at support@scanee.ai. Attach it to your PIA.

Conclusion

Entrusting your invoices to Scanee means entrusting a provider with documents that often hold personal information. The law asks you to assess that choice, frame it in writing and set retention. AI processing in the United States is the main point of your assessment; this document and the security brief give you the facts to address it.

Next step. Start your PIA with the table in section 5. For a question it doesn’t cover, or for the written agreement, write to us at support@scanee.ai.