Privacy policy

What this site collects, what it does not, and what happens to anything you send us.

We are a security company, so we have written this the way we would want it written for us: short, specific, and describing only what actually happens. Everything on this page can be checked from outside — see Audit us.

Last updated 29 August 2026.

Reading this site collects nothing

This website is a set of static files. It sets no cookies, runs no analytics, and loads nothing from any third party — no fonts from Google, no embedded videos, no advertising or tracking pixels, no social buttons. There is no login and no database behind it.

That is not a preference, it is enforced: the site sends a content security policy that forbids scripts entirely, and an automated check refuses to publish the site if a third-party request ever appears on any page.

Our hosting provider keeps standard request logs — the kind every web server keeps, including an IP address and the page requested — for a short period, to deliver the site and to block attacks. We do not use those logs to build a profile of you, and we do not combine them with anything else.

What we collect when you write to us

Only what you type into the form, and nothing gathered quietly alongside it:

Your name and work email address — required, so we can reply.
Your firm’s website and what kind of firm it is — optional, so the reply is useful rather than generic.
Your message — optional, and whatever you choose to put in it.

The form also contains one hidden field that is never sent anywhere. It exists to catch automated spam, which fills in every field it finds; a person never sees it and never fills it in. We mention it because “hidden field” sounds worse than it is.

Please do not send us confidential client information through this form. If you need to tell us something sensitive, say so and we will arrange a proper channel.

What we do with it

We use what you send us for three things, and nothing else:

To reply to you.
To prepare the free Security Snapshot, if that is what you asked for.
To keep a record of the conversation, so that if we speak again we know what was already said.

Your enquiry arrives in our company email and is also recorded in our own client-management system, which we run ourselves rather than renting from a customer-data platform. We do not sell your information, rent it, trade it, or hand it to advertisers or data brokers. We do not add you to a marketing list because you asked us a question — if we ever want to send you something you did not ask for, we will ask first.

If you ask for a Security Snapshot

The Snapshot looks at your firm the way an outsider can: we read what your domain publishes publicly — the same kind of lookup any mail server or browser performs — and what your own website already shows to visitors. We do not log in to anything, test any password, or send anything to your systems. We only look at what is already public, and only after you have asked us to.

The findings are yours. We keep a copy so we can answer questions about it later, and we do not publish it or show it to anyone else.

Who else can see it

A small number of suppliers necessarily handle your message in transit: the company that hosts and delivers this website, and the company that provides our email. They act on our instructions and may not use your information for their own purposes. Nobody else receives it.

Some of these suppliers operate internationally, so your information may be processed outside Canada and, while it is there, may be accessible to the courts and authorities of that country under its laws. We would rather say that plainly than bury it.

We would disclose your information without asking you only if the law required it — a court order, for example. If that ever happened and we were permitted to tell you, we would.

How long we keep it

If you become a client, for as long as you are one and then as long as our professional and legal obligations require. If you do not, we keep your enquiry for 24 months and then delete it, so that a conversation you have forgotten about does not sit in our systems indefinitely.

You can ask us to delete it sooner, and we will.

How it is protected

The same controls we would put in place for a client: access limited to the people who need it, multi-factor authentication on the accounts that hold it, encryption in transit, and a key held by the website that can deliver mail to one address and do nothing else, so a compromise of the website cannot be used to send mail as us.

No one can promise a breach will never happen. If one did, and it created a real risk of significant harm to you, we would report it to the Privacy Commissioner of Canada and tell you — that is the law, and we have written elsewhere on this site about firms that did not.

Your rights

Under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), you can ask us to:

tell you what personal information we hold about you, and give you a copy;
correct anything that is wrong;
delete it;
explain what we have used it for and who has seen it.

Email contact@cyberlegionnaire.com and we will respond within 30 days. We will not charge you, and we will not ask why.

Questions, and complaining about us

Kubera Desai is accountable for privacy at Cyber Legionnaire. Write to contact@cyberlegionnaire.com with anything at all — a question, a correction, or a complaint.

If we do not resolve it to your satisfaction, you can complain to the Office of the Privacy Commissioner of Canada, who supervises us under PIPEDA: priv.gc.ca. You do not need our permission, and you do not have to come to us first.

Changes to this policy

If what we do changes, this page changes with it, and the date at the top changes too. We will not quietly broaden it: if we ever start collecting something new, it will say so here before it starts.

Claim	Figure	Basis
Most small firms have no security budget at all	84.5%	of Canadian businesses with 5–19 employees had no dedicated cybersecurity budget (92.0% at 1–4 employees; 69.8% at 20–99). Separately, most businesses (54.4%) had no plans to take any new or additional cybersecurity action in the following 12 months, and the most common reason given was not needing cybersecurity measures (57.1%).
Most small Canadian professional firms can be impersonated by email	77%	of small Canadian professional firms with a website have no enforced DMARC — meaning anyone can send email that appears to come from them, and the receiving server has not been told to reject it. We measured this ourselves across 3,821 firm domains, because no independent source publishes it.
Recovery spending doubled in two years	$1.2 billion	is what Canadian businesses spent recovering from cyber security incidents in 2023, double the roughly $600 million spent in 2021 — while total spending on prevention and detection rose only from $9.7 billion to $11.0 billion. Small businesses accounted for about $300 million of the recovery bill.
For most small firms, the IT provider IS the security plan	50%	of Canadian businesses had any employees responsible for cyber security in 2023 — down from 61% in 2021. Among those without, the most common reason given was that they use consultants or contractors instead (47%).
Your CCO personally certified your cybersecurity answers to the OSC	G10	Every OSC-registered firm answers the Risk Assessment Questionnaire, and from 2026 the Chief Compliance Officer must personally certify each section — including Question G10 on cybersecurity. CIRO Dealer Members additionally have three days from discovering an incident to report it. Neither the certification nor the deadline can be satisfied by a firm that would not notice an incident in the first place.
Clients and partners now require security measures in writing	44%	of Canadian businesses were required to implement cyber security measures by suppliers, customers, partners or regulators, or to meet the requirements of security standards or certification programs — up from 29% two years earlier. Statistics Canada, 2019 and 2017. Inside the legal profession the ABA measures the same pressure directly, and finds it concentrated in larger firms: 15% at 2–9 lawyers against 59% at 50–99.
Your insurer asks whether you enforce MFA before it will quote you	MFA	is the control insurers ask about first, in writing, on their own application forms — Coalition's Canadian questionnaire and Beazley's US one both ask whether it is enforced on email and remote access, alongside tested backups and patching. Aon's 2025 report still calls it "an underwriting requirement" in a buyer-friendly market. Travelers rescinded a policy after a ransomware claim where the MFA represented on the application did not exist.
Corporate clients hand law firms a security schedule — their own association wrote one	24 hours	is the breach-notification window in the Association of Corporate Counsel's model security schedule — a ready-made set of controls written for in-house counsel to impose on the outside firms they retain. 27% of US law firms have been asked for their security requirements document; at 2–9 lawyers it is 15%.

Figure	What it measures
84.5%	of Canadian businesses with 5–19 employees had NO dedicated cybersecurity budget, Q3 2024. By size: 92.0% at 1–4 employees, 84.5% at 5–19, 69.8% at 20–99, 43.2% at 100+. Statistics Canada table 33-10-0875-01, vector v1594328208; StatCan rates this estimate's quality "excellent".
54.4%	of businesses had no plans to take new or additional cybersecurity actions over the next 12 months — and among the reasons given, the most common was not needing cybersecurity measures (57.1%). That is the "hope" in the sentence above. Canadian Survey on Business Conditions, Q3 2024.
37.0%	of Canadian legal-services businesses had no employee whose regular responsibilities include cyber security in 2023 — 38.6% of accounting, tax and bookkeeping practices, and 37.6% of ambulatory health care. Statistics Canada table 22-10-0129-01, vectors v1212389881 / v1212389887 / v1212390001.

Figure	What it measures
$1.2 billion	"Total spending on recovery from cyber security incidents also increased in 2023, doubling from approximately $600 million in 2021 to $1.2 billion in 2023." Prevention and detection spending over the same period went from $9.7 billion to $11.0 billion — recovery is the line that doubled.
$300 million	"Large businesses accounted for almost half of total spending on recovery from cyber security incidents in 2023 (about $500 million), while medium-sized and small businesses each spent approximately $300 million." Small businesses carry a quarter of the national recovery bill.
≈ $12,600	OUR ARITHMETIC, shown so you can check it: $300 million ÷ ≈23,800 small businesses impacted in 2023 (170,000 × 14%, the same calculation as the "1 in 7" table on this page). It is an average, and a skewed one — among small businesses actually impacted in 2023, 35.5% described the incident's effect as minor (Statistics Canada table 22-10-0133-01), so most sit below this figure and a few sit far above it.
Not in this number	Lost clients, lost billable hours, the cost of notifying everyone whose data was in a mailbox, and reputational damage. StatCan measures money spent recovering, not total harm. For a professional firm the uncounted half is usually the larger one, and no Canadian source quantifies it at this size — which is why we do not put a figure on it here.

Figure	What it measures
50%	of Canadian businesses reported having cyber security employees in 2023, "down from 61% in 2021" — so the share with nobody in-house is growing, not shrinking.
47%	of businesses without cyber security employees said the reason was that they "used consultants or contractors to monitor cyber security". For most small firms the outsourced IT relationship IS the security plan.
26%	of Canadian businesses had written policies for cyber security in place in 2023 — unchanged from 2021. Three in four have none.
46%	of Canadian businesses monitored their network and business systems in 2023 — the most common cyber security activity, and still a minority. "The most common cyber security activity in 2023 was monitoring network and business systems (46%), followed by monitoring insider threat risk behaviours (22%)."
Why this matters	Outsourcing is sensible; we are not arguing otherwise, and we work alongside incumbent IT providers. The distinction is one of discipline: keeping systems running and keeping a motivated attacker out are different jobs requiring different skills. We do not publish a figure rating anyone else's competence, because no independent body measures it — only vendors selling to that market do.