Your data stays in your country, under your control
DynaCore is sold as a data-sovereign system. US clients are hosted entirely in the United States: production, database, storage, backups and disaster recovery. The platform, the content and the configuration belong to you, and you can take them with you.
DynaCore is sold as a data-sovereign system. Canadian clients are hosted entirely in Canada: production, database, storage, backups and disaster recovery, with an optional Canada-based WAF and CDN. The platform, the content and the configuration belong to you, and you can take them with you.
Ask for the security assessment and data residency details in a live demo.
Book a live demoIn-country hosting
Production, database, file storage, backups and disaster recovery stay in US regions.Production, database, file storage, backups and disaster recovery stay in Canadian regions. Public cached content may use global edge nodes; authoritative data never does.
Separated front and back
Public site delivered through Vercel or Cloudflare; CMS and data on DigitalOcean or Google Cloud. Drafts, credentials and administrative records stay outside public caches.
WAF, CDN and DDoS protection
Web application firewall, rate limiting and DDoS mitigation are part of the hosting price, not an add-on. An optional Canada-based WAF and CDN is available for clients whose policy requires edge caching to stay in-country.
In transit and at rest
TLS 1.3 where supported, TLS 1.2 minimum; provider-managed AES-256 encryption at rest; managed certificates.
Least privilege, named accounts
Role-based and field-level permissions, SSO (SAML / OAuth), MFA for administrators, audit logs for every administrative action.
Dev, staging, production
Controlled releases with tested updates and documented rollback. Logical tenant isolation per client.
Your content and data, in writing
DynaCore is delivered as a managed service, and public-sector RFPs increasingly ask what the client keeps. With DynaCore the answer is written into the agreement.
You own all client-specific content, data, code, configuration, themes, integrations and documentation.
You can export structured content in JSON or CSV, original files and media, a manifest of content types and relationships, and the redirect register, at any time and at end of contract.
You can leave with everything you brought and everything you created. A documented exit plan covers export, credential handover and certified deletion.
Open foundations. Strapi, Node.js, React and Next.js, PostgreSQL. Your IT team can read and run it.
Exit plan. Transition plan with export timing, credential handover, domain coordination and certified deletion of your data from Blü systems.
Transparent fees. Platform fee, hosting and support are itemized; nothing is bundled into a licence you cannot see.
Service levels we put in the agreement
| Measure | Standard commitment | Notes |
|---|---|---|
| Availability | 99.9% monthly | Measured per calendar month on the Blü-managed service; remedies stated in the SLA. |
| Backups | Daily, automated | Application data, CMS database, configuration and authoritative files, with completion monitoring. |
| Retention | 7 to 30 days | Daily recovery points; extended retention under the selected service schedule. |
| Recovery point objective | 24 hours | Maximum data-loss window. |
| Recovery time objective | 3 hours | Restoration of the managed service after a declared qualifying incident. |
| Restore testing | Quarterly | Documented restore tests, plus validation before launch. |
| Monitoring | 24x7 | Availability and application health with on-call escalation and an emergency line. |
| Critical incident response | 1 hour | Through the emergency route; continuous effort until stabilized. |
Need these commitments in your SLA language? We will go through them line by line.
Book a live demoEvidence we provide with a proposal
Third-party assessment
Independent security and accessibility assessment of DynaCore (2026), available on request under NDA.
Independent penetration test
Priced into implementation when required, performed by a firm independent of Blü and its subcontractors, with findings remediated before launch.
Current VPAT
WCAG 2.2 AA conformance report, refreshed June 2026.
Data security procedures
Written procedures covering access, credentials, incident response, change control and personnel.
Personnel controls
Background checks for staff with staging or production access; US-based project lead for US clients.
Background checks for staff with staging or production access; Canadian-based delivery team in Ottawa, Montreal and Toronto.
Privacy tooling
Consent management, state privacy-law tools, public-records retention support and controlled logging.
Consent management, PIPEDA and provincial privacy-law tools, records-retention support and controlled logging.
Need the security questionnaire filled in?
Send us your questionnaire or the security section of your RFP. We answer every control with evidence, not assurances.