Regulated money, handled by the book

Jmoor operates at the intersection of several regulated domains — privacy, payments, anti-money-laundering, and statutory payroll and tax. We build the platform to meet those obligations by design, and we give customers the transparency and documentation they need to meet their own.

Compliance is treated as an ongoing program rather than a one-time checkbox: obligations are mapped to concrete controls in the product, those controls are monitored, and our posture is reviewed as regulations and the platform evolve.

Jmoor’s program is built around the frameworks most relevant to a Canadian-built financial platform serving businesses internationally:

Jmoor’s handling of personal information is designed with reference to Canadian privacy law (PIPEDA), GDPR-style transparency principles, and U.S. expectations such as CCPA/CPRA where applicable.

Because Jmoor moves money, it operates within payments and anti-money-laundering frameworks and integrates the controls those frameworks expect.

Card & payment security

Card data is captured and tokenized by PCI-DSS-certified processors, keeping Jmoor aligned with a PCI DSS SAQ-A posture; raw card numbers are not stored by Jmoor. Payment flows use idempotency and signed, de-duplicated webhooks end to end.

Anti-money-laundering (AML) & KYC

Jmoor is registered with FINTRAC and applies AML-oriented controls including customer identification, monitoring for suspicious activity, and record-keeping appropriate to the services provided.

Sanctions & watchlist screening

Jmoor screens against sanctions and watchlist data (using OpenSanctions and comparable sources) to help prevent prohibited transactions and relationships.

Jmoor computes and prepares statutory payroll and tax obligations, and — as a CRA Authorized Representative — is approved to file on behalf of employers with the Canada Revenue Agency.

Filings are computed and prepared ready-to-file; where direct government submission requires customer credentials or authorization, those steps are performed with the customer’s consent and are clearly indicated in-product.

Jmoor is built in Canada and primarily hosts customer data in Canadian infrastructure. Where a service depends on a third-party sub-processor operating in another region, that relationship is governed by appropriate contractual and technical safeguards. Customers with specific residency requirements can contact us to discuss their needs.

Jmoor relies on a limited set of vetted sub-processors to deliver the service — principally certified payment processors and rails, infrastructure and email providers. Sub-processors are selected and reviewed for their own security and compliance posture, and are bound by contractual obligations covering confidentiality and data protection.

Payment orchestration spans certified processors including VoPay, Finix, Helcim, Checkout.com, Mollie, Airwallex, Wise, and Lithic. A current sub-processor list is available to customers on request.

Jmoor is pursuing SOC 2 Type II attestation of its security, availability, and confidentiality controls, and maintains internal control documentation in the meantime. On request and under appropriate confidentiality terms, we can provide security and compliance documentation to support customer due diligence.

Compliance is a partnership. Jmoor is responsible for the security and compliance of the platform itself; customers are responsible for how they configure and use it, and for their own regulatory obligations.

For compliance questions, documentation requests, data-subject requests, or due-diligence inquiries, contact our compliance team. We aim to respond promptly and to support your review process.