Trust & security

PathwayCheck is an independent service. It is not affiliated with, endorsed by, or acting for the Government of Canada, IRCC, or any provincial or territorial government.

Nothing here is an application, and nothing you enter is sent to any government. Results say a pathway appears to match published criteria, may match with missing information, or requires verification — never that you are eligible or approved.

• You can complete the whole questionnaire without an account. Those answers stay in your own browser.
• If you sign in, your in-progress assessment is saved to your account so you can continue on another device. You can clear it with “Start over” or delete it with your account.
• A finished assessment is stored only if you choose “Save”. Nothing is saved automatically for an anonymous visitor.
• Your answers are yours. We do not sell them, share them with advertisers, or use them to market to anyone.

The full detail — every field, every storage location, every retention rule — is in the Privacy Policy.

• Sign-in is a one-time link emailed to you. There is no applicant password for anyone to steal, guess, or reuse.
• Session cookies are HTTP-only, sent only over HTTPS in production, and are not used for tracking or advertising.
• You can download everything your account holds as JSON, and you can delete the account permanently, from the Account page.

• Payment is handled by Stripe on Stripe's own checkout page. Your card number never reaches our servers and we never store it.
• We record that your account paid, and the Stripe references needed to support a refund — nothing more.
• One payment, charged once. It is not a subscription and it does not renew.
• Access to paid results is checked on our servers on every request, not hidden in the browser.

• Traffic is encrypted in transit (HTTPS) and the application runs on managed cloud hosting.
• Account data is held in a managed Postgres database in the United States, kept separate from the database of published government rules. Recent point-in-time recovery history exists so the database can be restored after an incident.
• Sign-in and support email is sent through an email provider. We do not keep copies of the sign-in emails themselves.
• Error reports go to an error-monitoring service so faults get fixed. It is configured for errors only — no session recording, no behavioural tracking, and no automatic collection of personal data.
• There are no advertising or analytics trackers on this site, and no third-party tracking cookies.

Day-to-day operations — payments, refunds, service health — are done in a separate administration portal on its own address, with its own login and a second authentication factor. Signing in as a customer never grants any administrative access, and administrative sign-in never uses a customer account.

Every pathway is assessed against criteria published by the responsible government: 131 pathways across 14 jurisdictions, from 221 official federal, provincial and territorial sources. Each pathway shows the sources behind it and when we last verified them — most recently October 7, 2026.

PathwayCheck does not hold SOC 2, ISO 27001, or any privacy certification, and has not yet had an independent penetration test. We would rather say so here than display a badge that means nothing. Improving this is on our roadmap; when something is genuinely issued to us, it will appear on this page with the date and the assessor.

We also do not publish customer testimonials, ratings or user counts, because we have not yet asked any customer for permission to do so.

If you believe you have found a security or privacy problem, email support@pathwaycheck.ca with enough detail to reproduce it. We will acknowledge you, and we will not pursue anyone who reports a genuine issue in good faith and does not access, alter or retain another person's data.