PIPEDA + CPPA Compliance

ALTCHA is a privacy-first solution designed to simplify compliance with Canada’s federal privacy laws, including PIPEDA and the forthcoming CPPA. Self-hosted, it operates entirely within your infrastructure, eliminating external data processing or third-party tracking — ensuring user data remains under your control and within Canadian jurisdiction. ALTCHA is also available as ALTCHA Cloud, hosted entirely within the EU — note that Cloud does not keep data within Canada, so if in-country residency is a requirement for your organization, self-hosting is the applicable deployment.

PIPEDA + CPPA Compliance

1. No Cookies or Tracking

ALTCHA does not use:

• Cookies nor Persistent Identifiers – No cookie consent banners required under PIPEDA.
• Personalized Tracking – Verification logs are anonymized, with no ties to individual users.

For more technical details on how Sentinel respects and protects user privacy, please see the Privacy Protection documentation.

2. Fully Self-Hosted (for In-Canada Residency)

• All data processing occurs on your Canadian servers—no reliance on external providers or cross-border data transfers.
• No third-party dependencies—simplifying compliance with CPPA’s strict data localization and vendor accountability requirements.
• If you instead use ALTCHA Cloud, data is processed on ALTCHA's infrastructure within the EU — a cross-border transfer relative to Canada, so confirm this fits your organization's data residency requirements before choosing Cloud.

3. No Personal Data Storage

• Verifies interactions without collecting identifiable user information (e.g., names, emails, or persistent IPs).
• IP addresses and metadata are anonymized or discarded, avoiding classification as "personal information" under PIPEDA.

4. No Subprocessors or Data Sharing

• Zero third-party vendors—eliminating PIPEDA/CPPA obligations for vendor audits or contractual safeguards.

Compliance Checklist

While ALTCHA is compliant by design, ensure your implementation adheres to Canadian privacy best practices:

• No Cookie Consent – Zero tracking cookies mean no additional disclosures under PIPEDA.
• Data Minimization – Collects only non-identifiable data (if any), aligning with CPPA’s purpose-limiting principles.
• User Rights Automation – No stored personal data = no access/correction/deletion requests.
• Canadian Data Residency – Self-hosting keeps data within Canada, avoiding cross-border transfer complexities; ALTCHA Cloud instead processes data within the EU.

Why It Matters

Compliance with PIPEDA and CPPA is streamlined with ALTCHA:

• Self-hosted = Full control over data jurisdiction, including keeping data within Canada (ALTCHA Cloud instead processes data within the EU).
• No tracking = Reduced risk of breaches or non-compliance.
• No cookies = Simplified user trust and transparency.

By design, ALTCHA minimizes legal overhead while upholding Canada’s privacy standards.

---

ALTCHA is designed to support CPPA-compliant implementations, but final responsibility for regulatory compliance lies with you, the data controller. Ensure your deployment does not introduce additional data processing or storage beyond what ALTCHA provides.