Frequently asked questions
Plain-language answers that match what Orion actually does today. Where something is not decided, we say so.
8 questions
Why is identity information requested?
Providers must know who they are serving, and Orion needs it to assess applications and prevent fraud and hidden merchants. Legal requirements may also apply. Only the information needed for these purposes is requested.
Who receives merchant information?
Orion staff with a role that needs it, the provider you apply to, and service providers that host or secure the platform under contract. Merchant information is not sold.
Where is data stored?
[Hosting region to be confirmed]. Orion does not promise Canadian-only hosting; providers may process data outside Canada.
How long is data retained?
[Retention periods to be set]. Retention will be based on the life of the account, the period refunds and disputes can occur, and legal record-keeping requirements.
How can I request correction or access?
Contact the Privacy Officer (contact to be confirmed). We will verify your identity and respond within the legal time limit. Information on public blockchains cannot be changed by Orion.
How are incidents handled?
Orion contains the issue, preserves evidence, assesses the risk to individuals, and notifies affected people and regulators where the law requires. A staff runbook covers these steps; security monitoring is not yet in place.
Is Orion registered, licensed or insured?
Not currently. FINTRAC: [FINTRAC MSB registration status not determined]. Bank of Canada RPAA: [Bank of Canada RPAA registration status not determined]. Insurance: [Insurance not in place]. Whether registrations are required is being assessed with counsel.
Does regulatory registration mean endorsement?
No. Registration with a regulator such as FINTRAC is not a licence, an endorsement or a guarantee. A provider's registration does not cover Orion either.