Bill 25 is more than a cookie banner.
Personal information protection affects how you collect, store, share and secure your clients' data. We help you take stock and implement what's needed, step by step.
Six areas, several ways we can help
Bill 25 applies to any organization that collects personal information in Quebec, regardless of size.
Collection and consent
You must inform your users about what you collect and obtain their explicit consent. This is the most visible requirement and the starting point.
Our tool: MoelleuxClassification and lifecycle
What information do you hold? Where is it? How long do you keep it? Bill 25 requires you to know and document this.
Discover CatégoData Security
Your personal data must be protected against unauthorized access, leaks and incidents. This involves your hosting, access controls and practices.
Our service: Security AnalysisLegacy systems
Outdated software, a misconfigured database or a legacy system can become a compliance risk. Upgrading is part of the equation.
Our service: Web ApplicationsIncident management
In the event of a breach, you have reporting obligations. Having a plan in place before it happens is a requirement, not an option.
Our service: ConsultingPrivacy officer
Bill 25 requires the designation of a privacy officer within your organization.
We can help you structure this roleThe visible starting point: your consent banner.
It's often the first obligation SMBs address, and that's normal. We developed Moelleux so it's done right, without complex configuration.
Automatic scan of your site
Moelleux detects your cookies, third-party scripts and forms in seconds.
Bilingual privacy policy
Your privacy policy is automatically generated in French and English, compliant with the mandatory sections of Bill 25.
Included in our Silver plans and above
If you host with us, you don't need to look elsewhere. It's already there.
Available in white-label
For agencies that want to offer compliance to their clients under their own brand.
Catégo handles the heart of Law 25
Where Moelleux handles consent, Catégo covers the essentials: inventory and categorization of your information assets, records of processing activities, and privacy impact assessments. Built for SMBs, non-profits, and health and social services organizations.
Asset categorization (DICT)
Classify your information assets using the DICT model: Availability, Integrity, Confidentiality, Traceability. AI proposes a justified classification, you validate.
Records of processing (RoPA)
Document your personal-data processing activities in a structured register (RoPA), exportable to PDF for your records and the CAI.
AI-assisted PIA
Generate your privacy impact assessments. AI drafts, you decide: everything stays traceable and auditable. AI proposes, you validate.
First month free, no credit card. Hosted in Canada. Law 25, GDPR and PIPEDA.
Agencies and MSPs: Catégo offers a reseller program. Become a reseller
Compliance starts with choosing the right partners
As a hosting provider, we're part of your data processing chain. It's a responsibility we take seriously.
Data hosted in Canada
All our primary servers are located in Canadian data centers. Your data doesn't transit through the United States.
Certified partners
Our infrastructure and third-party service providers are selected for their compliance with recognized standards: SOC 2 and ISO 27001 as applicable.
Multi-layered security
Network protection, environment isolation, restricted access, active monitoring. Security isn't a checkbox — it's a daily practice.
Processing transparency
We can provide the necessary documentation on how we process hosted data. Useful for your own compliance records.
Compliance isn't a destination — it's an ongoing practice
Obligations evolve. Your site evolves. Tools change. We're here to help you stay current, not just check boxes once.
Cross-cutting across our services
Hosting, development, email, security. Bill 25 compliance runs through everything we do. You don't need to coordinate ten different vendors.
An opportunity as much as an obligation
Done right, privacy becomes a competitive advantage. Your clients trust you more when they see you take it seriously.
Our standards, your peace of mind
We apply the same requirements to our own infrastructure as what we recommend to our clients.
Not sure where to start?
Most SMBs are in the same situation. Bill 25 is broad and the obligations aren't always clear. A single conversation is enough to take stock.
No-commitment assessment
We review your current situation and tell you honestly where you stand.
A step-by-step plan
No need to do everything at once. We prioritize based on your actual risks and available resources.
Services that fit together
Compliant hosting, consent tool, security analysis, system upgrades. We can cover multiple areas without multiplying vendors.
The sectors that rely on this service
The same service does not solve the same problem depending on your field. Here is what it changes concretely, sector by sector.
Regulated Professionals
Records of processing (RoPA), DICT categorization of your assets and privacy impact assessments. This is the vocabulary your professional obligations already use.
See the sectorPublic Administration
A public body has heightened obligations. Records of processing, DICT categorization and PIAs, exportable to PDF for your files and for the Commission d'accès à l'information.
See the sectorUnions, Professional Orders and Associations
Records of processing activities and categorization of what you hold on your members, exportable to PDF. Enough to answer an access request without improvising.
See the sectorHealth and Private Clinics
Catégo is built in part for health and social services organizations: records of processing, DICT categorization and assisted PIAs, exportable for your files and for the CAI.
See the sectorWhere do you stand with Bill 25?
A first conversation to review your obligations and identify priority steps — no legal jargon, no pressure.
Free initial consultation. No commitment. Response within 24 business hours.