Movahedi Solutions
Trust Center
Movahedi Solutions is an independent privacy and AI governance consultancy in Mississauga, Ontario, Canada. This Trust Center states, with dates and links, what the company does, how it handles client material, and how its public site is protected. Each section starts with the plain answer and points to the page with the evidence.
7
Self-assessments published
Each labelled as a self-assessment, not a certification. See Self-Assessments.
A+
Third-party header scan
Security Headers, October 28, 2026, 00:59 UTC. A header scan, not a penetration test.
7
Services offered
Listed under Company and service scope, below.
Contents
- 01Company and service scopeThe company, its services, and how engagements work
- 02Privacy and data handlingPractice for client material, in plain language
- 03Security controls and incident responseWebsite protection, engagement controls, and the incident route
- 04Certifications and assessment evidenceCredentials, self-assessments, questionnaires, and dated scans
- 05Supporting documentsDated documents, the due-diligence package, and how to request more
- 06Contact and security reportingOne route for security questions and issue reports
1. Company and service scope
1000823315 ONTARIO INC., operating as Movahedi Solutions, is an independent privacy and AI governance consultancy based in Mississauga, Ontario, Canada.
The company offers six services: AI Governance; Privacy and Data Governance; Cookie and Script Governance; Process Excellence; Custom AI and Data Solutions; Fractional Advisory. These are services. They are not certifications, and they are not a promise of a client outcome.
Services
- AI Governance
- Privacy & Data Governance
- Cookie & Script Governance
- Process Excellence
- Custom AI & Data Solutions
- Fractional Advisory
The company's work is led by its founder, Mohammad Movahedi, whose personal credentials include ISC2 Certified in Cybersecurity (CC), CIPP/C, and Lean Six Sigma coursework (LinkedIn Learning, 2022), with employment background at The Globe and Mail and TELUS. Those credentials are personal. They are not company certifications. Detail: Certificates. Who answers for security risk: Who is accountable.
How engagements work
An engagement is scoped advisory work, agreed in writing before work starts. Any specific security, screening, or insurance requirement for that engagement is confirmed in writing before work starts. At engagement end, client material is returned or deleted on the client's instruction, as set out in the Privacy Notice for Engagements (October 27, 2026). Detail: Documents and Services Coverage.
Buyer routes by need: Buyer Pathways.
2. Privacy and data handling
These five promises hold for every engagement:
- Client data is never sold.
- Client data is not used to train models.
- Client data is used only for its engagement.
- No client is named publicly without written permission.
- Client information is returned or deleted at engagement end, on the client's instruction.
Access to client material is limited to the people working on that engagement, and removed when it ends. No client data is stored on the public website, and no public case study is built from client work without written permission.
Data collected
| Data | Collected for an engagement |
|---|---|
| Material provided by the client for the engagement | Yes |
| Correspondence needed to run the engagement | Yes |
| Payment card details | No |
| Personal health information | No |
Detail: Privacy and Data Handling. The Website Privacy Policy (last updated October 29, 2026) covers the website itself: Privacy Policy.
3. Security controls and incident response
Public site
movahedi.ca is served over HTTPS through Cloudflare. The dated third-party header scan result is on Security Practices. SSL Labs returned grade A on all four endpoints, assessed October 28, 2026, at 01:00:26 UTC.
Scan links:Security Headers: movahedi.ca· SSL Labs: movahedi.ca. DNS and email checks: DNS and SSL Checks. A security contact file is published at movahedi.ca/.well-known/security.txt.
Engagement controls
Engagement material is used only for its engagement. Access is limited to the people working on that engagement and removed when it ends. The tools used for an engagement are agreed with the client, because they depend on the engagement. Storage locations, retention periods, and access rules for an engagement are confirmed in writing for that engagement before material is shared.
Incident response
Report a suspected security issue to mohammad@movahedi.ca, or use the Security Issue Report form. The founder triages each report, and where client material is affected, the affected client is notified directly. Notification timing for an engagement is agreed in writing for that engagement before material is shared.
Detail: Security Practices, Continuity and Incidents, Encryption Statement, Vulnerability Disclosure Policy, Responsible Disclosure.
4. Certifications and assessment evidence
The founder holds ISC2 Certified in Cybersecurity (CC), CIPP/C, and Lean Six Sigma coursework (LinkedIn Learning, 2022). These are personal credentials, not company certifications. The company holds no SOC 2, ISO 27001, or ISO 42001 certification. Detail: Certificates.
Seven self-assessments are published, each labelled as a self-assessment, not a certification, audit, or third-party verification: Privacy, AI Governance, Cybersecurity, and Website Accessibility and Privacy Self-Check, plus CAIQ-Lite, NIST CSF Matrix, and CIS Controls v8 and MVSP Alignment. Detail: Self-Assessments.
The Vendor Security Questionnaire answers 60 questions in 12 categories (October 27-29, 2026), and the Security Questionnaire Answers page answers 12 common questions. Regulatory mappings for NIS2, DORA, GDPR, HIPAA, and ISO/IEC 42001 are mappings only, not compliance claims: Regulatory Mappings.
Dated, checkable control status: Recorded process checks.
5. Supporting documents
Finished documents, each dated, are published on the Documents page:
- Capability Statement, October 27, 2026.
- Privacy Notice for Engagements, October 27, 2026.
- Terms of Engagement, October 27, 2026.
- Vendor Security Questionnaire, October 27-29, 2026.
- Security Practices, October 29, 2026.
- Privacy Policy for the website, last updated October 29, 2026.
The Due-Diligence Package gathers the finished documents with dates and links, including the full package as a downloadable zip and the 60-question questionnaire. The Reviewer's Guide is a one-page guide to the package. The DPA Summary states what a signed agreement for an engagement would cover; it is a summary, not a signed Data Processing Addendum.
Short answers to common buyer questions: FAQ. Documents not listed as public are available through the Document Request Procedure.
6. Contact and security reporting
For security and privacy questions about Movahedi Solutions, contact mohammad@movahedi.ca. To report a security issue on movahedi.ca, use the Security Issue Report form, which prepares an email to that address in your own email program. The site itself does not send the report. To request a document, use the Document Request page. To request a tailored questionnaire response, contact mohammad@movahedi.ca naming the questionnaire and the deadline.
Scope and limits: this Trust Center is company information, not legal advice for a specific client matter and not a law firm opinion. Where a matter is confirmed per engagement, it is stated as such on the relevant page and confirmed in writing for that engagement before work starts.
Updates
Each change adds a dated line. Old dates are kept when a page changes, and history is not rewritten.
- October 27, 2026: Trust Center published. Registrations and third-party listings verified live, each as its own dated entry. Security Practices, Privacy and Data Handling, Responsible Disclosure, Document Request Procedure, Security Questionnaire Answers, and the Vendor Security Questionnaire finished the same day.
- October 28, 2026, 00:59 UTC: third-party header scan of movahedi.ca recorded (see Security Practices). SSL Labs returned grade A on all four endpoints, assessed October 28, 2026, at 01:00:26 UTC.
- October 29, 2026: Trust Center reorganized into six sections (company and service scope; privacy and data handling; security controls and incident response; certifications and assessment evidence; supporting documents; contact and security reporting). The Vendor Security Questionnaire gained a security baseline summary. Registrations entries were shortened to verified status only.
- October 29, 2026: second review pass. Internal workflow language removed from public pages. The questionnaire's change-approval answer updated to describe the actual release process (source control, automated build, style check, internal link check, no deploy on failure). Third Parties reorganized into technical checks, directory listings, and procurement registrations. Privacy Policy now names the company as operator, dated October 29, 2026. Certificates page gained issuer links. Location wording standardized to Mississauga, Ontario, Canada.