Governed automation platform · Canada
Probaro runs your processes end to end, requires human sign-off before every risky action, and keeps proof of everything that happened. Built in Canada, hosted in Canada.
No sign-up. Nothing to configure. One call, thirty minutes.
The problem
An automation can fail without adequate monitoring, and reconstructing what happened is hard when logs are incomplete. And when a vendor processes personal information outside Quebec, section 17 of Law 25 requires your organization to run a privacy impact assessment.
What changes
Our primary hosting is in Canada, at Beauharnois. Your privacy impact assessment is still required; we document our data flows and subprocessors, which may simplify the part of the analysis dealing with transfers outside Quebec.
Who ran what, on whose authority, at what cost. Timestamped, attributed, exportable — six months later included.
The real cost of every run, per client. Caps evaluated before execution: depending on the configured policy, an overrun blocks the run or holds it.
Four guarantees
A run cannot execute from a prompt.
Natural language produces a reviewable artifact; the artifact — not the prompt — is what runs.
You don't pick the model in the workflow. Your organization does.
No provider binding, no AI execution. Token, cost and concurrency caps enforced before execution — not discovered on the invoice.
Your secrets never leave the vault in clear text.
They are stored encrypted and materialized in runtime memory only for the duration of the call. They appear in no workflow definition, no log and no export. A run that cannot satisfy its credential contract does not start.
No ambient operator access to your data.
Two separate authority scopes. Support access exists, but requires an explicit, time-bounded and audited session — never a property of merely being an operator.
Sovereignty · Law 25
Section 17 of Quebec's Law 25 requires a privacy impact assessment before entrusting the processing of personal information outside Quebec, taking into account the legal regime of the processing location. Section 3.3 may separately require an assessment when acquiring a system that processes personal information, even with no transfer. The obligation exists either way: what differs between vendors is how hard the assessment is, and how good an answer you can put in it.
| Vendor | Canadian residency | Exposure to foreign law | Difficulty of your assessment |
|---|---|---|---|
| Zapier, Make, Workato | Partial | To assess | High |
| Hyperscalers, Canadian region | Yes | To assess | High |
| Probaro | Targeted | Reduced | Low |
Indicative reading. Real exposure depends on the contracting entity, its affiliates, the applicable jurisdiction and who holds possession, custody or control of the data — not only on where the server sits. Validate your data flows with your privacy officer.
Who produced your privacy impact assessment for Zapier, and when was it last updated?
The question to put to your team this week.
Use cases
An inbound call creates or finds the contact, captures qualification, updates the CRM and triggers follow-up. No lead lost.
Demonstrates: signed webhooks and replay protection
Nothing publishes without human sign-off. The policy blocks before the send, not after.
Demonstrates: blocking human approval inside the engine
Performance thresholds raise an alert, and every budget decision goes through an approval.
Demonstrates: threshold policy evaluated before the action
Pricing · Canadian dollars
390 $ / month
1 290 $ / month
3 290 $ / month
On request
Six months at 50% against a twelve-month commitment, one documented client case, and two hours of feedback per month.
Contact
Thirty minutes. We listen, we sell nothing.
No. Natural language produces a reviewable artifact; the artifact — not the prompt — is what runs. That is what makes a run replayable identically.
Yes. Workflow nodes call models. It is the orchestration that stays deterministic: every call goes through an activity, which is what makes its result journalized and replayable.
Your organization, not the workflow author. With no provider binding, there is no AI execution. Token, cost and concurrency caps are enforced before execution.
They stay encrypted in the vault and are materialized in runtime memory only for the duration of the call. They appear in no workflow definition, no log and no export. A run that cannot satisfy its credential contract does not start.
There is no ambient access. Support access exists, but requires an explicit, time-bounded and audited session — never a property of merely being an operator.
Processing resumes at the interrupted step, not at the beginning. Nothing is sent twice, no step is skipped.
