Movahedi Solutions
Documents
1000823315 ONTARIO INC., operating as Movahedi Solutions, Mississauga, Ontario, Canada. Contact: mohammad@movahedi.ca. Finished documents are published below, each with its date. Each document is company information. Where a matter is to be confirmed per engagement, it is stated as such in the document, and it is confirmed in writing for that engagement before work starts.
Access layers: public, on request, under agreement
Public documents are published below and can be read directly. Documents not listed as public are available through the Document Request Procedure: name the document, and the reply sends the current version with its date, where it exists. Material available only under a signed agreement is routed through that agreement, with the requirement and the route stated in the reply, not left silent. A document that does not exist is described as not existing, with a related document offered where one covers the subject. No document is created in response to a request and presented as if it already existed.
Document index
| Document | Date | Detail |
|---|---|---|
| Capability Statement | October 27, 2026 | Company, seven services, how engagements are agreed |
| Privacy Notice for Engagements | October 27, 2026 | How client material is used, access, engagement end |
| Terms of Engagement | October 27, 2026 | Scope, rate, term, payment, controls, handover |
| Vendor Security Questionnaire | October 27-28, 2026 | 60 questions, 12 categories |
| Security Questionnaire Answers | October 27, 2026 | 12 questions |
| Privacy Self-Assessment | October 27, 2026 | Self-assessment, 8 main sections, PIPEDA and Law 25 topics |
| AI Governance Self-Assessment | October 27, 2026 | Self-assessment, 8 main sections, NIST AI Risk Management Framework |
| Cybersecurity Self-Assessment | October 28, 2026 | Self-assessment, 9 main sections, NIST Cybersecurity Framework |
| Website Accessibility and Privacy Self-Check | October 28, 2026 | Self-assessment, 7 main sections, live site check, October 28, 2026 |
| CAIQ-Lite Self-Assessment | October 28, 2026 | Self-assessment, 16 domains, 32 questions |
| NIST CSF Matrix Self-Assessment | October 28, 2026 | Self-assessment, 18 rows, 6 functions |
| CIS Controls v8 and MVSP Alignment | October 28, 2026 | Self-assessment, 16 verified items, 10 CIS controls and 6 MVSP items |
| DNS and SSL Checks | October 28, 2026 | SPF, DKIM, DMARC, mail routing, SSL Labs grade A |
| Who is accountable | October 29, 2026 | Accountability statement |
| Secure Software Development Lifecycle | October 28, 2026 | Development lifecycle section |
| Infrastructure and Cloud Architecture | October 27, 2026 | Infrastructure section |
| Business Continuity and Incident Management | October 27, 2026 | Continuity section |
| Compliance, Regulatory, and Third-Party Risk | October 27, 2026 | Compliance section |
| Subprocessors | October 29, 2026 | Vendor list, verified rows only |
| Encryption Statement | October 28, 2026 | Public site facts and engagement provisions, split in two |
| Vulnerability Disclosure Policy | October 27, 2026 | Formal disclosure policy, movahedi.ca only |
| Data Processing Addendum Summary | October 27, 2026 | Summary only, not a signed addendum |
| How work is planned, checked, and improved | October 28, 2026 | DMAIC in plain form, Recorded process checks table |
| How We Work Securely | October 27, 2026 | Company practice summary, including What We Do Not Do With Client Material |
| Reviewer's Guide | October 27, 2026 | One-page guide with checked references |
| Security Practices | October 27, 2026 | Security practices page |
| Privacy and Data Handling | October 27, 2026 | Privacy practice page |
| Responsible Disclosure | October 27, 2026 | Disclosure page |
| Website Privacy Policy | Last updated October 29, 2026 | Website privacy policy |
| Security Headers scan | October 28, 2026, 00:59 UTC | Grade A+, third-party header scan, not a penetration test |
| Services Coverage | October 27, 2026 | What each of the seven services covers, what it does not, and what is confirmed per engagement |
| Regulatory Mappings | October 27, 2026 | Mappings to NIS2, DORA, GDPR, HIPAA, and ISO/IEC 42001, labelled as mappings only |
| Buyer Pathways | October 27, 2026 | Routes by buyer need, as service pathways only |
Capability Statement
Issued by Movahedi Solutions. Date: October 27, 2026. Contact: mohammad@movahedi.ca.
Movahedi Solutions is the operating name of 1000823315 ONTARIO INC., based in Mississauga, Ontario, Canada.
About the company
Movahedi Solutions is an independent privacy and AI governance consultancy based in Mississauga, Ontario. We offer AI Governance; Privacy and Data Governance; Cookie and Script Governance; Process Excellence; Custom AI and Data Solutions; and Fractional Advisory. Prior employment of the founder includes The Globe and Mail and TELUS.
Services
- AI Governance: AI use-case inventories, risk tiering, acceptable use and model governance policy, shadow AI discovery, executive briefings, and EU AI Act readiness work.
- Privacy and Data Governance: privacy programs and data governance, including notices, consent design, request handling, and Law 25 support.
- Cookie and Script Governance: cookie and script register, CMP declaration, third-party chain map, audit cycle.
- Process Excellence: process improvement for privacy and compliance operations.
- Custom AI and Data Solutions: custom AI and data builds fitted to the engagement, including knowledge-base design and build.
- Fractional Advisory: on-demand senior privacy and AI governance leadership.
These are services only, not certifications, and not a promise of a client outcome.
How engagements are agreed
Scope for an engagement is agreed in writing before work starts. The terms that govern an engagement are set out in the Terms of Engagement below and in the written agreement for that engagement.
Privacy Notice for Engagements
Issued by Movahedi Solutions. Date: October 27, 2026. Contact: mohammad@movahedi.ca.
Movahedi Solutions is the operating name of 1000823315 ONTARIO INC., based in Mississauga, Ontario, Canada. This notice applies to client material provided to Movahedi Solutions for an engagement.
Use of client material
Client material is used only for the engagement it was provided for. It is not used for any other engagement, and it is not used for any other purpose.
Access
Access to client material is limited to the people who need it to carry out the engagement. Access is not shared beyond that group.
End of engagement
At the end of an engagement, client material is returned or deleted, on the client's instruction. The client states which of return or delete applies, and Movahedi Solutions acts on that instruction.
No sale, no training use, no naming
Client material is not sold. Client material is not used to train models. A client is not named as a client, in any public material or in any reference, without the client's written permission.
What this notice states for engagement-specific provisions
Where a client requires a specific provision on encryption, data residency, or retention, that provision is confirmed in writing for the engagement before work starts, under the Terms of Engagement below. Detail: Privacy and Data Handling.
Terms of Engagement
Issued by Movahedi Solutions. Date: October 27, 2026. Contact: mohammad@movahedi.ca.
Movahedi Solutions is the operating name of 1000823315 ONTARIO INC., based in Mississauga, Ontario, Canada. These terms apply to an engagement with Movahedi Solutions, together with the written agreement for that engagement. Where these terms and the written agreement for an engagement differ, the written agreement for that engagement governs.
Scope agreed before work starts
The scope of work for an engagement is agreed in writing before work starts. Work outside the agreed scope is not carried out unless a change to the scope is agreed in writing.
Rate, term, and payment
The rate for an engagement is agreed in writing for the engagement. The term of an engagement is agreed in writing for the engagement. Payment terms for an engagement are agreed in writing for the engagement. No rate, term, or payment figure is stated in these terms, because each is set for the engagement in its written agreement.
Controls and handover
The controls that apply to an engagement, and the handover at the end of an engagement, are stated in the written agreement for that engagement. Handover includes the return or delete of client material, on the client's instruction, as set out in the Privacy Notice for Engagements above.
Security, screening, and insurance requirements
Any specific security requirement, screening requirement, or insurance requirement that applies to an engagement is confirmed in writing before work starts. No such requirement is assumed from these terms alone. Where a client requires a specific provision on security, screening, or insurance, that provision is written into the agreement for the engagement before work starts.
Changes
A change to scope, rate, term, payment, controls, or handover is agreed in writing before the changed work is carried out.
Client material
Client material is used only for the engagement it was provided for, as set out in the Privacy Notice for Engagements above. A client is not named as a client, in any public material or in any reference, without the client's written permission.
How this works
A buyer reads a public document directly from its link, or requests a document through the Document Request page, naming the document and the purpose. A public document is read in its current dated version. An on-request document is sent by email in its current version, with its date. Material under agreement is routed to the agreement step, with the requirement stated.
Related pages
- Trust Center
- Document Request
- Security Questionnaire Answers
- Vendor Security Questionnaire
- Self-Assessments
- Certificates
Scope and limits, stated briefly
These documents are company information. Contact: mohammad@movahedi.ca.