Data Sovereignty Statement

Three distinct frameworks

We recognise three distinct Indigenous data sovereignty frameworks, and we treat them as distinct throughout our operations.

The deciding voice

For any CFC^™ designee, programme, or record that touches Indigenous data, the deciding voice is the keyholder designated by the relevant First Nation, Métis government, or Inuit body. CAFE coordinates with that keyholder. We do not make decisions on their behalf.

Our hosting model

The CAFE Certification Command Centre is hosted on the Serving Ethics server, a Canadian-located server stewarded by William Moores. We use no third-party cloud, no US-domiciled sub-processor for designee data, and no US-citizen administrative access to designee or Indigenous data.

For the full sub-processor disclosure, see the Security Policy.

How CAFE handles Indigenous identity disclosures

A designee’s Indigenous identity is theirs. When a designee discloses Indigenous identity, Nation, or community to CAFE, that disclosure happens directly and orally between the designee and CAFE staff. We do not transcribe, paraphrase, or store the substance of that conversation anywhere in the platform. The platform records only the operational compliance markers that the designee themselves chooses to enable in their profile. The disclosure itself stays with the designee.

Layered, voluntary opt-in

Every Indigenous-related data point in the platform is optional and gated by its own consent toggle controlled by the designee. Eligibility for certification does not depend on providing any of this information. The designee chooses, separately, whether to:

• 1Record an Indigenous identity bucket (First Nations, Métis, Inuit, “Prefer not to say”, or “Not Applicable”)
• 2Record a specific Nation or community name
• 3Consent to CAFE contacting their Nation or community about their certification
• 4Display their Indigenous identity in the public CFC^™ directory
• 5Display their Nation or community in the public CFC^™ directory
• 6Receive a privacy-enhanced certificate that carries no Indigenous identity markers

Selecting “Not Applicable” or “Prefer not to say” cascades through every dependent flag and clears it. Consent can be withdrawn at any time. The platform retains a record of the consent itself for seven years, as required by PIPEDA. The underlying disclosure the designee shared orally is not stored at any point.

The certificate as the designee’s record

Once a designee earns the CFC^™ designation, the certificate PDF is theirs to generate and hold. Certificate export is restricted to the authenticated designee and operates only within their own session. Only the designee can generate their own certificate document. The resulting PDF carries the designee’s credentials within the document itself, so the certificate remains a valid and verifiable record independent of connectivity to the platform.

Each designee may choose, via their profile, a privacy-enhanced certificate that contains no Indigenous identity markers; that certificate carries identical standing to a standard certificate and only changes what appears on the document the designee holds. Once downloaded, the PDF is the designee’s record. CAFE does not retroactively alter it, redistribute it, or republish it.

Why this design

First Nations OCAP, Métis articulations, and Inuit NISR all centre the principle that Indigenous information is held by the rights-holder. CAFE applies that same principle at the individual level: the disclosure stays in the designee’s voice, on the designee’s certificate, under the designee’s control. The compliance markers we retain are the audit trail of what the designee chose to enable.

Client-level data

CAFE holds no records of who a designee serves. The framework distinction matters here as well: collective Indigenous data resides with the Nation or community.