A fixed-price gap analysis, remediation through to your audit, and upkeep after it. All in a workspace you keep.
All compliance →Led by a published security researcher with five CVEs. One standard report, letters for your buyers, and retests of your fixes.
All security →To the people you sell to, raise from or answer to.
All industries →Original research, free tools, and plain-language guides on security and compliance, from a published security researcher.
Read the blog →A DPIA (Data Protection Impact Assessment) or PIA (Privacy Impact Assessment) is a structured evaluation of how a project affects personal information before it goes ahead. It identifies the data involved, the risks to individuals, and the measures that reduce those risks. The GDPR mandates a DPIA for high-risk processing, and Quebec Law 25 requires a privacy impact assessment for certain projects and for transfers of personal information outside Quebec.
The value is in the timing. A PIA run during design catches a risky data flow while changing it still costs a conversation, whereas one run after launch mostly documents risk you are now stuck with.
It also produces the evidence a regulator or buyer asks for. Quebec Law 25 effectively assumes you can show your assessment for in-scope projects, so the record is the deliverable, not the meeting.
traztech delivers privacy impact assessments and privacy officer support for startups and growth-stage companies, led by a published security researcher.
Book a callFor a broader look at getting audit-ready, see our SOC 2 readiness work, or talk to a fractional CISO about building a program around it.
A PIA is usually prompted by a new project rather than by curiosity: a new system, a new use of data, or a transfer outside the province. For companies subject to Quebec Law 25 it is a legal requirement in defined situations, not a best-practice nicety. We run these through our privacy officer support.
Done at design time, it is cheap and it shapes the build; done after launch, it becomes a scramble to justify decisions already made. The output that matters is the record of what was assessed, what risks were found, and what you changed in response. See our Quebec Law 25 entry for when it is mandatory.
Under the GDPR, for processing likely to result in high risk to individuals. Under Quebec Law 25, for projects involving acquiring, developing, or overhauling systems that handle personal information, and before transferring personal information outside Quebec.
They are essentially the same exercise under different names. DPIA is the GDPR term; PIA is the more general label used across Canadian privacy practice. The goal is identical: assess and reduce privacy risk before proceeding.
Free PDFs, no card
SOC 2 readiness, ISO 27001 gaps, incident response and vendor security, as PDFs you can print or forward. Free, no card.
From Jacob Masse, principal of traztech: the files by email, then a few short notes over the next month. No spam, unsubscribe in one click.
Track record
Five published CVEs. CVE-2024-45163 (CVSS 9.1) is a flaw in the Mirai botnet itself, which gave defenders a way to shut down attacker infrastructure. CVE-2026-42626 takes HP ENVY 5000 printers offline from any unauthenticated device on the same network.
At Humera, a venture-backed US security company, Jacob built the compliance programme in-house from nothing: no report, no policies, no documented controls. It ended in a Type II attestation with zero exceptions.