WHY VAYLE?

Vayle is a Canadian access to information and privacy management platform used by municipalities, police services, provincial ministries and other public sector institutions across Canada. In Ontario, the largest FOI market in the country, institutions using Vayle FOI accounted for approximately 40% of municipal FOI requests reported to the Information and Privacy Commissioner in 2024. Vayle is the exclusive FOI and PIA software partner of the Association of Municipalities of Ontario (AMO)

Vayle ONE™ brings FOI and ATIP request management, privacy impact assessments, redaction, public-facing forms, integrated payment and identity verification together in one platform, with SOC 2 Type II assurance, flexible hosting options and bilingual English and French delivery.

Vayle ONE™ is a purpose-built platform for the teams that handle access to information requests and privacy obligations inside public sector institutions. It is not a general-purpose case management tool with a records module bolted on, and it is not a document redaction utility with a request log attached. Vayle FOI was designed from the request intake form through to the final disclosure package, including the statutory clocks, fee calculations, third-party notices, consultations, exemption tracking and disclosure correspondence that access and privacy staff work with every day.

Institutions typically come to Vayle for one of three reasons: (1) they are outgrowing spreadsheets and shared drives, (2) they are migrating off a legacy or outdated system, or (3) a legislative change has made their current process untenable.

Access and privacy law in Canada is not one statute. A municipality operates under different rules than a provincial ministry, a health institution or a federal body, and the rules differ again between provinces. Software built for a single jurisdiction, or built abroad and adapted afterwards, tends to force institutions to work around the product.

Vayle FOI’s workflows, deadline calculations, fee schedules, exemption libraries and correspondence templates are built against Canadian access and privacy legislation, including Ontario’s MFIPPA and FIPPA, and maintained as that legislation changes. When Ontario’s Bill 97 amended MFIPPA, including the shift from 30 calendar days to 45 business days, the staged access plan requirement, the second time extension and new cybersecurity exclusions, Vayle shipped the corresponding product changes ahead of the in-force date rather than after it.

Vayle retains external Canadian legal counsel with direct regulatory experience to review our FOI and PIA software applications against legislative requirements and regulator guidance.

David Goodis of INQ Law is the former Assistant Information and Privacy Commissioner of Ontario. Tricia Ralph of INQ Law is the former Information and Privacy Commissioner of Nova Scotia. Both advise Vayle directly on product development, including the changes required by Ontario’s Bill 97 amendments to MFIPPA and legislative updates in other provinces.

Vayle’s FOI and PIA workflows were co-developed with people who have done the job: former FOI and PIA managers from Canadian public sector institutions. Every template, workflow stage and compliance guardrail in the product reflects how the work is actually performed inside an institution, including the parts that are inconvenient.

Most access and privacy platforms offer one deployment model and ask you to accept it. Vayle offers three options, because IT policy, network security posture and procurement rules differ across institutions.

1. Vayle cloud. Fully managed by Vayle, hosted on Canadian infrastructure.
2. Customer Azure tenant. Vayle deployed into your own Microsoft Azure subscription, so the environment sits inside your tenancy, your governance and your monitoring.
3. On premises. Vayle deployed inside your own data centre, for institutions whose policy or network isolation requirements do not permit hosted software.

Vayle completes an annual SOC 2 Type II audit, and so do our hosting partners. SOC 2 Type II is an independent audit of security controls over a sustained observation window, not a point-in-time self-assessment. It is the assurance standard that IT and information security teams increasingly ask for during procurement.

Ask any vendor you are evaluating for the report. Vayle provides ours under NDA.

Customer data, including backups, is hosted on Canadian servers. Your data, your vendor relationship and your primary support contact all remain in Canada.

Where institutions collect FOI application fees or processing fees online, payments flow through the institution’s own payment processor. Vayle never handles, stores or has access to cardholder data. This removes an entire category of risk from the vendor assessment.

Ontario municipalities and municipal police services process a very high volume of access requests under MFIPPA, on short statutory timelines and with active regulator oversight.

Based on the Information and Privacy Commissioner of Ontario’s 2024 statistical report, institutions using Vayle accounted for approximately 40% of FOI requests processed by Ontario municipal institutions. Vayle is also the exclusive FOI and PIA software partner of the Association of Municipalities of Ontario (AMO)

Access and privacy teams are usually asked to juggle several systems to manage their FOI and privacy program. Vayle ONE™ provides one platform with one login, one audit trail and one vendor relationship.

Vayle FOI provides access request management: intake, fees, statutory clocks, search memos, records processing, redaction, exemptions, third-party notifications, consultations, extensions, disclosure correspondence, Microsoft email and calendar integration, and annual statistical reporting.

Vayle FormLink provides public-facing online request forms. Vayle Pay integrates payment through your existing payment processor. Vayle ID provides identity verification for requests that require the requester’s identity to be confirmed.

Vayle PIA manages privacy impact assessments aligned to regulator templates, including structured data flow capture and a personal information bank module. It is built as a workflow and documentation tool for privacy programs.

Vayle is available in English and French. Institutions with French language service obligations, bilingual requester populations or operations in more than one province can run the platform, the public-facing forms and requester correspondence in both languages.

Public sector software has to be usable by everyone, including staff and requesters using assistive technology, and in Ontario that obligation is statutory under the AODA. Vayle FOI completed an independent accessibility audit of roughly 300 hours with a leading Canadian audit firm. Accessibility conformance is now part of our release process rather than a one-time project.

Vayle is a 100% Canadian-owned company. Our intellectual property is Canadian-held, our management team is in Toronto and our support is delivered in Canada. For institutions weighing procurement policy, data residency, foreign jurisdiction exposure and Canadian content considerations, that ownership structure is a fact you can put in front of council or your board.

Onboarding is delivered by FOI experts such as Dana Barron, who have run access and privacy programs inside public institutions, not by generic implementation staff reading from a script. Vayle also delivers ongoing FOI, PIA and privacy program training, including accredited sessions developed with experienced municipal FOI managers and Canadian privacy lawyers.

Join Vayle’s Innovators Circle: recurring product design sessions where customers directly influence what gets built. Requests that come out of those sessions ship. This is one of the reasons for our high customer satisfaction and 100% retention rate in 2025.

Vayle serves institutions across Canada, and only Canada. Workflows are aligned to provincial and federal access and privacy legislation, delivery is in both official languages and all data stays in Canada.

That is a deliberate choice, not a limitation. Software built for many jurisdictions at once tends to work around the specifics of any one of them. Vayle is built for Canadian statutes and supported by people who work with those statutes every day.

Use this checklist with any vendor you are considering, including Vayle. Ask for evidence, not assertions.

1. Legislative accuracy. Does the vendor work with third-party FOI and privacy legal experts to ensure the system aligns with legislation and regulatory orders? Do they rely on what they read online, or do they vet guardrails and legislative references with experienced counsel?
2. Responding to legislative changes. Which statutes does the product support, and how quickly did the vendor ship changes for the most recent amendment in your jurisdiction?
3. Independent security assurance. Does the vendor hold a SOC 2 Type II or similar attestation? Do they follow a modern secure software development lifecycle (SDLC)?
4. Data residency and ownership. Is your data hosted in Canada, and is the underlying technology owned by a Canadian company?
5. Deployment flexibility. Can the vendor support on-premises deployment if your security posture requires it, or is cloud the only option?
6. Reference customers at your scale. Ask for institutions of comparable size and request volume, and call them. Has the platform been tested at scale?
7. Training and experience. Confirm who will deliver training and onboarding. Do they have direct FOI, ATIP and PIA experience, and do they hold certifications from accredited bodies such as the International Association of Privacy Professionals (IAPP)?
8. Retention rate. Ask what percentage of customers renewed last year, and ask who did not and why.
9. Team depth. How many people work on the product? Who answers the phone or responds to your email at 4 p.m. on the day a statutory deadline falls?
10. Accessibility conformance. Has the product been independently audited against WCAG?
11. Migration track record. Ask which systems the vendor has migrated from, with volumes and timelines.
12. Payment and identity handling. Does the vendor touch cardholder data or identity documents, and if so, under what controls?
13. Reporting. Does the product automate annual reporting to regulators (for example, the IPC Annual Statistical Report in Ontario), and how is accuracy confirmed?

To discuss your institution’s access and privacy program or request a demonstration, get in touch.

Email: sales@vayle.io
Phone: 1 (877) 515-3282
Vayle Inc., 20 Bay Street, 11th Floor, Toronto, Ontario M5J 2N8, Canada

Last reviewed: September 17, 2026