AI development company for Canadian teams that ship.

Our engagement defaults are aligned with PIPEDA (Personal Information Protection and Electronic Documents Act) federally and Quebec Law 25 (Act respecting the protection of personal information in the private sector, as amended in 2021-2023) for engagements involving Quebec-resident personal information. DPAs are signed before any personal information is shared, and we run a Privacy Impact Assessment (PIA) for engagements processing personal information at scale. For Law 25 specifically, we support the obligations on consent transparency, automated decision-making disclosure, data portability, and the right to de-indexation. For British Columbia clients, BC PIPA controls layer on top. For Alberta, PIPA-AB.

Your call on the region. We default to AWS ca-central-1 (Montreal) for Eastern Canadian clients or for Quebec Law 25 cohorts that want in-province residency, Azure Canada Central (Toronto), or GCP northamerica-northeast1 (Montreal) or northamerica-northeast2 (Toronto). For inference, we pin Claude or GPT-4o to a Canadian or US region depending on what your privacy officer approves — or we self-host Llama 3 on vLLM inside your Canadian VPC for zero third-party inference. No Canadian personal information silently crosses the border unless your DPA explicitly permits it.

Honest answer: Eastern Canadian hours (Toronto, Montreal, Ottawa) get a native two-to-three-hour late-afternoon overlap with our Mohali IST day, which is workable but not full coverage. For Eastern clients that need same-zone synchronous time, we route a dedicated overlap pod through our Frisco, TX office — Frisco runs Central Time, which is one hour behind Toronto but covers the same workday. Western Canadian hours (Vancouver, Calgary) are thinner; we cover them async-first with twice-weekly demos scheduled in your morning. If your engagement genuinely cannot survive without synchronous coverage at all hours, we will tell you on the first call.

Yes. We have shipped AI chatbots and voice agents in English and Quebec French. For voice agents specifically, we route Deepgram for Quebec French STT and ElevenLabs or Azure Neural TTS for Quebec French voices, with prompt tuning on Quebecois conventions rather than Parisian French. RAG retrieval is multilingual by default — your knowledge base can mix English and French documents and the agent retrieves from both. For consent and transparency notices, we draft in both languages with a translator review where the engagement touches Law 25 obligations.

Most v1 engagements at Aiinfox land between CAD $35,000 and CAD $160,000 fixed-price for a focused build — an AI agent, a RAG system, a voice pipeline, or a bespoke ML model. Larger multi-quarter engagements with fine-tuning, custom evals, and Quebec Law 25 compliance work typically reach CAD $200,000 to CAD $350,000. Pilots are usually CAD $12,000 to CAD $25,000 with acceptance criteria written into scope. Canadian clients invoice in CAD via wire transfer or USD by preference. We are a registered Indian entity invoicing as a foreign corporation — no T4A entanglement.

Yes — that is the most common Canadian deployment pattern we run. We work inside your AWS ca-central-1 (Montreal), Azure Canada Central (Toronto), or GCP northamerica-northeast1 / northeast2 account using your IAM, your VPC, and your customer-managed encryption keys. For inference, we route to Canadian or US endpoints depending on your DPA, or we self-host Llama 3 on vLLM inside your VPC if your team requires zero third-party inference. No data leaves your cloud unless your runbook says it should.

Yes. We have shipped KYC automation, FINTRAC-aware transaction monitoring, fraud signal extraction, and deterministic-output compliance copilots for fintech and lending operators serving Canadian and US markets. Every model and tool call is audit-logged with input, output, prompt version, and operator identity — so the Chief Compliance Officer accountable for the system has the evidence they need for OSFI examinations or FINTRAC audits. We do not make autonomous regulatory decisions; humans approve everything that touches a regulated outcome.

Yes — takeover audits are routine. Step one is reading the code, the data pipelines, the eval results (if any exist), the prompts, and the cost telemetry. Step two is shipping the smallest valuable change to prove we understand the system. Step three is the longer-term plan — incremental stabilisation, a parallel rebuild, or shutting it down and starting over. We will be honest on the first call about which is the right move. Most takeovers we have seen did not need a full rewrite; they needed evals, guardrails, observability, and a senior engineer on the build.