Trust

Buying FirePermit.Online

For the clerk, the CAO or the treasurer who has to approve what the fire chief has asked for. The five questions that decide these purchases, answered in advance — plus the privacy impact assessment your municipality will need from 1 January 2027, already drafted.

Last updated 26 August 2026

Who you would be contracting with

Legal entity

Fractal SAAS Inc., 64 Hurontario St, Suite 200, Collingwood, Ontario L9Y 2L6, Canada. FirePermit.Online is a business name of that company.

Operating since

Departments have been issuing permits through the service since 2020, in Canada and the United States. They range from rural townships with fewer than a thousand permanent residents and a volunteer roster to towns of twenty-five thousand with full-time prevention staff — which is the range the product is built for, rather than a single size of department.

References

A reference call with a department of comparable size is available on request, and is usually more useful than anything on this site.

Insurance

Commercial general liability, cyber liability, and errors and omissions cover are all in place. Certificates naming your municipality are provided on request.

Your privacy impact assessment, drafted

A burn permit system collects a resident’s name, address, contact details and property location. Wherever you are, somebody is going to ask you to write down what it collects, why, where it goes and who can reach it — whether that is a statutory privacy impact assessment, an IT vendor risk review, or a question from a councillor who read something worrying. Rather than hand you a blank template, we supply that assessment already filled in for the parts only the vendor can answer.

In Ontario this stops being good practice and becomes law on 1 January 2027: municipal institutions must conduct a privacy impact assessment before collecting personal information in a new information system, and must notify the Information and Privacy Commissioner and affected individuals of certain privacy breaches, with annual statistics first reported in 2028. Elsewhere in Canada and in the United States the obligation is usually your own policy rather than a statute — the work is the same either way, and so is the document we hand you.

The personal information collected, field by field, and why each field exists.

The purpose of the collection, and the information flows — resident to department, department to responder, and the alerting path out to permit holders.

Every sub-processor, what it touches, and where it operates.

Technical and administrative safeguards, in the form the assessment asks for rather than in marketing language.

Retention, disposal, and the resident’s access and correction routes under MFIPPA.

Two things are deliberately left blank, because they are yours and not ours: the by-law, ordinance or statutory authority under which your department collects the information, and your records retention schedule. We will not guess at either.

Who owns the data, and how you get it back

The question behind the question is usually “what happens to us if this vendor goes away”. It deserves a direct answer.

Ownership

Permit records are your municipality’s or district’s records. We hold and process them on your instruction, and nothing about the arrangement moves custody or control to us. That is what keeps your obligations under your own public records law intact and answerable — MFIPPA in Ontario, the equivalent provincial access statute elsewhere in Canada, and your state’s public records or sunshine law in the United States.

Public records and FOI requests

A request for a permit record goes to your department and is answered by you, because it is your record. Where you need us to retrieve, filter or format something in order to answer one within your statutory clock, we do that as part of the service and not as billable work.

Getting the data out

Your permit records are exportable in a machine-readable format on request at any point in the term, not only at the end of it. There is no charge for an export.

Where the records are held

Permit records and resident accounts are stored in Google Cloud’s Montréal region. Payment, messaging and email processing happen outside Canada through Stripe, Twilio and Resend; the security page names which is which.

Retention

Your retention schedule governs how long the department’s records are kept. Tell us the schedule and we hold to it; we do not impose one of our own.

On exit

A full export of your records at termination, in the same machine-readable format available to you throughout the term.

If we cease operating

Ninety days of continued service or assisted migration from the date we give notice, on top of the export you can take at any time. Ninety days is chosen against how municipalities actually decide things — it is one council cycle, not one billing cycle.

The honest version of the continuity question: we are a small company, and no commitment on this page changes that. What it does change is that you are never more than one export away from holding your own records, and that if we wind down you get a quarter of a year rather than a notice period.

Accessibility

A resident portal published under your department’s name is your web content, and the accessibility obligation attached to it is yours rather than your vendor’s. That is true on both sides of the border, and in the United States it now has a date on it.

United States — the Department of Justice rule under ADA Title II requires WCAG 2.1 Level AA for state and local government web content. Compliance dates were extended in April 2026 to 26 April 2027 for entities serving 50,000 or more people, and 26 April 2028 for smaller entities and special districts.

Ontario — the Integrated Accessibility Standards Regulation reaches web content an organisation controls “directly or through a contractual relationship that allows for modification”, at WCAG 2.0 Level AA, and has since 1 January 2021.

We build to WCAG 2.1 Level AA, which covers both the Ontario requirement of WCAG 2.0 AA and the ADA Title II standard that applies to our United States departments.

Every release is tested automatically before it ships, and the accessibility page publishes the results — including the failures. There is no independent audit behind that claim and we say so on the page rather than in a footnote.

A written conformance report for the version you are evaluating is available on request and can be attached to a council report or an RFP response.

It lists what has been tested, with which tools, how often, and what is still open — including the issues we have not fixed yet. Read the accessibility page

Getting it approved

Every municipality and fire district has a purchasing policy, and nearly all of them set a value below which a direct award or a couple of written quotes is enough — Ontario municipalities under section 270 of the Municipal Act, US departments under a local purchasing ordinance or a state threshold. We do not know yours. The paperwork on our side is built so you can meet whichever one applies without us having to be told which it is.

A written quote naming the annual cost, on request, in a form you can attach to a purchase requisition.

A single-source or sole-source justification memo where your policy requires one, setting out what the system does that a general-purpose permitting or forms product does not.

Cooperative or piggyback purchasing paperwork where your state or region allows an existing award to be ridden rather than a fresh solicitation run.

Completed vendor questionnaires and security schedules — send yours rather than reading ours.

A draft council, board or committee report covering the problem, the cost, the alternatives and the recommendation, for you to edit rather than write.

Pricing

Quoted per department rather than published, because a township of nine hundred and a town of twenty-five thousand are not the same purchase. A written quote you can attach to a requisition comes back within two business days of asking.

Contract

A one-year term. Either party may decline renewal on thirty days’ notice. There is no multi-year lock and no automatic renewal you have to catch a window to escape.

Implementation

Setup, configuration to your open-air burning by-law, and staff training are included. Most departments are live in days rather than weeks.

Support

Email and phone, weekdays 9am to 5pm Eastern. Onboarding and training are not billed separately.

The procurement pack

Ask and we send the set: the pre-filled privacy impact assessment, the security questionnaire answers, the accessibility conformance report, the data ownership and exit terms, and the draft council report. It is prepared for your municipality by name rather than sent as a generic bundle, which takes about a day.

There is no cost and no obligation attached to asking. If you read it and decide the answer is no, you keep the assessment — the work of describing this class of system does not go to waste.

Something here not answered?

Send the questionnaire, the by-law, or the question. A person answers it — we would rather write the answer down once than have you guess at it.

info@firepermit.online · Procurement pack