Virtual Mailbox Privacy in Montreal: Mail and Scan Custody Audit

Executive Summary

A virtual mailbox in Montreal solves two different privacy problems, and most provider pages address only one. Address privacy concerns what a public register or a supplier can learn about where a business or its owners are located. Content privacy concerns who opens, scans, stores and destroys the letters that arrive. Quebec's enterprise register is described by the government as a public information bank ^[1], and enterprises must declare the home addresses of shareholders, directors, partners and officers ^[1], so an address service reduces exposure there only in limited ways. Letter contents are a separate matter, and this report treats them as a chain of custody that a buyer can audit.

Quebec's Act respecting the protection of personal information in the private sector (CQLR c P-39.1) applies whether an enterprise keeps information itself or through a third person ^[2], and the regulator, the Commission d'accès à l'information (CAI), states that a business remains responsible for personal information entrusted to others ^[3]. A mailbox provider that opens and scans letters is therefore a service provider whose handling the customer must be able to evidence. The statute requires a written mandate and a guarantee that the provider does not keep information after the contract ends ^[2]. Section 18.3 also requires the provider to notify the person in charge of personal information protection without delay of any violation or attempted violation of confidentiality obligations and to allow that person to conduct verifications ^[2]. For destruction by a third party, the CAI says a written contract must specify, among other things, that the provider acknowledges confidentiality ^[4] and notifies the client without delay of a breach or attempted breach ^[4].

Provider documentation reviewed in October 2026 is uneven. Some providers state that opening happens only with the customer's authorization, such as Swivl ^[5] and Traveling Mailbox ^[6]. Retention windows differ widely: one Montreal provider states a one-month physical retention period for important documents ^[7], while another service stores mail for as long as the account remains active ^[8]. Many pages reviewed did not state a scan retention period, a subcontractor list or an incident notice term. This report records those as gaps and does not infer them.

The practical conclusion is a set of proof requests and not a provider ranking. Before authorizing opening or scanning, a buyer can ask for the written contract terms, the opening permission record, the scan access and deletion rules, the destruction method and the incident notice commitment. Physical pickup, or exterior-only handling, is the conservative default for payroll, tax, banking and identity items. IBM's 2026 study put the average Canadian breach cost at a record CA$7.11 million ^[9], a reminder that third-party handling has a cost at scale. A questionnaire and a blank three-provider scorecard close the report.

Introduction and Background

Buyers searching "virtual mailbox privacy Montreal", "virtual mailbox Montreal" or "is a virtual mailbox private" know a virtual mailbox provides a street address and mail handling, and want to know how private it is. The question has three parts: whether the address exposes the owner, whether the provider's staff see letter contents, and whether digital copies persist after they are needed.

The report takes Quebec private-sector privacy guidance and the documented practices of providers, and converts them into audit steps. It does not rank providers, and it asserts no security certification, feature or benchmark for a provider unless that provider's own page states it. Provider statements are attributed as vendor claims and were read on 27 October 2026. Where a page is silent, the report says the page did not state the point, which is different from saying the control is absent.

Disclosure. The publisher, 2727coworking.com, is a direct provider of desks, private offices, meeting rooms, virtual offices and business addresses in Montreal, so it is one of the options a reader may be comparing. This report does not assess the publisher's terms and does not cite the publisher's pages. The final questionnaire applies to the publisher as to any provider.

Scope and limits. This is research and not legal advice. The CAI's business pages are in French, so the report paraphrases them. A lawyer or the business's person in charge of personal information protection should confirm how the rules apply to a specific arrangement. Several of the vendors reviewed are US-oriented services, and their pages may not describe Montreal operations.

Sensitivity matters because a single envelope can carry client names, staff details, tax identifiers or banking information. Under the statute, personal information is information that relates to a natural person and directly or indirectly allows that person to be identified ^[2]. A cheque stub, payroll notice or bank letter can therefore be personal information even when addressed to a company, which is why opening permission is treated here as a risk decision and not a convenience toggle.

Address Privacy Versus Content Privacy

What the address reveals

A virtual address changes which location appears on documents, but public registers have their own rules. The government states that the information held in the enterprise register is public and that enterprises are responsible for its accuracy ^[1]. A virtual mailbox does not remove the obligation to declare home addresses of shareholders, directors, partners and officers ^[1].

The Registraire des entreprises offers narrower options. For an individual whose home address would otherwise be published, the business may declare that person's business address if one exists ^[10], and a post office box cannot serve as that business address ^[10]. A person with reasonable grounds to believe disclosure is a serious threat to their safety can ask that personal information be made non-publishable ^[10]. For a legal person the domicile is the address of its registered office ^[11], which must be in Quebec ^[11]. The registrar's guide also describes an optional elected domicile for correspondence that should go elsewhere ^[11].

No official page located for this report states whether a commercial mailbox street address is acceptable as a registered office, establishment address or individual business address. That question should be put to the Registraire des entreprises or a lawyer before an address is declared. Federally, the Canada Revenue Agency (CRA) says a business mailing address can differ from the physical address, for example mail delivered to a home or an accountant ^[12], and post office boxes cannot be used as the business address ^[12].

What the contents reveal

Content privacy is about what is inside the envelope, and the mix of mail is changing. The CRA states it transitioned to online mail as the default method of delivering most business correspondence ^[13], and defines the correspondence as notices, letters, forms, statements and other documents ^[13]. Online correspondence is treated as received on the date it is posted to My Business Account ^[13]. A business that prefers paper must submit a formal request ^[13]. A business using a mailbox provider can often move CRA mail online, which removes a category of sensitive paper from the custody chain.

Revenu Québec likewise describes businesses registered in Mon dossier as receiving communications that can be sent online only electronically ^[14]. Paper still arrives: Revenu Québec says an up-to-date address ensures a business receives documents such as notices, forms or cheques ^[15]. Cheques and original notices are the items a buyer may prefer to collect in person.

If the main worry is exposing an owner's home, address and register choices dominate. If the worry is a provider's staff opening a letter that holds a client's banking details, the opening permission, scan access and destruction rules dominate. The remaining sections concentrate on the second problem, where provider pages are least uniform.

The Quebec Legal Frame: Who Is Responsible

The business keeps responsibility

The statute applies to personal information an enterprise holds, whether it keeps the information itself or through a third person ^[2], and the enterprise is responsible for protecting it ^[2]. The CAI says the rules cover information handled by an enterprise or by a third party such as an agent or service provider ^[16], and that a business always remains responsible for information entrusted to it ^[3]. If a provider opens an envelope containing personal information about staff or clients, the customer is the enterprise that must show reasonable safeguards. A provider's marketing page is not that evidence.

Safeguards scale with sensitivity

The statute requires security measures that are reasonable given the sensitivity of the information, the purposes of its use, its quantity and distribution, and its medium ^[2]. The CAI says the more exposed and sensitive the information, including when disclosed to suppliers, the more robust the safeguards must be ^[17]. It lists contract management attentive to personal information as a governance safeguard ^[17] and encryption of communications and stored information as a technical one ^[17]. This proportionality supports a tiered approach to mail, developed below.

Service provider contracts

The statute allows communication to a service provider without consent where necessary to carry out the mandate or contract ^[2], on conditions: the mandate must be in writing ^[2], and it must ensure the provider does not keep the information after the contract expires ^[2]. The CAI describes contract measures the contractor must take ^[3] and says the person in charge of personal information protection must be told without delay of a breach or attempted breach ^[18]. For destruction, the CAI says a written contract is needed when a third party is involved ^[4], and that if the provider does not respect its commitments the business will need to end the contract ^[4].

These are the clauses to look for in a mailbox agreement; a pricing page or website privacy policy is not a substitute.

Consent, location and the federal comparison

The CAI states that the necessity test takes precedence over consent ^[19] and that consent for sensitive information must be express ^[19]. This report does not resolve whether an opening authorization given to a mailbox provider is consent in the statutory sense or an instruction under a service contract. It recommends treating the authorization as an explicit, revocable, item-level decision.

If personal information is communicated outside Quebec, or an outside body is entrusted to keep it, the statute calls for a privacy impact assessment and a written agreement ^[2]. Whether a given scan hosting arrangement triggers that rule depends on facts the provider must disclose. As an example of why the question matters, Anytime Mailbox's FAQ says its physical servers are in a colocation facility in the USA ^[8]. That is a vendor statement and not a legal conclusion for any customer.

The federal Office of the Privacy Commissioner (OPC) is consistent on the main points. Under PIPEDA, an organization is responsible for information it transfers to a third party for processing ^[20], a contract is the primary means of protecting it ^[21], and the outsourcing organization should have a right to audit how the third party handles and stores it ^[21]. PIPEDA does not specify particular safeguards ^[22], which is why buyers must ask for specifics. A September 2026 OPC guidance document calls third-party assessment a key due diligence measure ^[23] and tells organizations to confirm whether a subcontractor will handle personal information ^[23].

The Canada Post Corporation Act makes it an offence to knowingly open, keep or detain mail except where authorized by law ^[24] and treats leaving mail with an addressee's agent, or another person reasonably considered authorized to receive it, as delivery to the addressee ^[25]. How those provisions apply to a commercial mailbox operator is a question for a lawyer.

Mapping the Mail Chain of Custody

A chain of custody records each handler, time and condition from carrier handoff to destruction or pickup. Table 1 below is an audit frame: the actor at each step, the evidence to request, the retention question and a stop condition that should pause authorization. It is this report's synthesis of the sources cited in the surrounding sections and not a provider's published process.

Steps 4 and 6 decide content privacy: the permission model decides who sees contents, and the access and retention rules decide how long a digital copy exists. The stop conditions are this report's recommendations for pausing authorization and are not statements about any provider. A buyer who cannot obtain the evidence for a step has found a gap to resolve before sending sensitive mail, which does not by itself show that a provider is unsafe.

Classifying Mail and Deciding When Not to Authorize Opening

A three-tier working classification

The classification below derives from the proportionality principle ^[17] and the statute's risk factors, which include the sensitivity of the information and the anticipated consequences of its use ^[2]. It is the report's own framework.

• Tier 1, routine: advertising, catalogues, general supplier notices with no personal or financial detail. Authorize disposal after exterior review.
• Tier 2, business-confidential: supplier invoices, contracts, client correspondence. Scan only on item-level request, with a retention limit and deletion on request.
• Tier 3, sensitive: tax notices, cheques, payroll or benefits documents, bank letters, identity documents, and anything naming individuals with financial or health detail. Default to no opening by the provider, and collect in person or arrange tracked forwarding.

When physical pickup is preferable

• Original paper has legal or financial value. Revenu Québec lists cheques among documents mailed to the address on file ^[15], and a scan does not replace an original.
• A government channel can move online. The CRA's online mail default ^[13] removes the item from the mailbox chain entirely.
• Retention or subcontractors are undocumented. If the questionnaire answers come back blank, keep sensitive items out of scanning.
• The item is legal or official correspondence. One provider's help center says it is not authorized to receive legal documents or official government correspondence ^[33]. That is a documented limit of that service, and it shows why each provider should be asked which categories it accepts.

Pickup has its own controls. One national chain states that additional authorized recipients must each present two valid forms of identification ^[26] and that possession of the mailbox key is treated as valid evidence of authorization to remove contents ^[26]. Ask who else holds keys or authorizations and whether collections are logged.

Scans, Retention, Subcontractors and Destruction

Transmission, access and storage

Provider pages describe scan security in general terms. Davinci states that scans are digitally encrypted when transmitted ^[29] and viewable only with the correct administrative login credentials ^[29]. PostScan Mail's FAQ states its cloud provider employs encryption in transit and at rest ^[34]. These are vendor statements, and none of the pages is an independent test. The Canadian Centre for Cyber Security recommends two-factor authentication wherever possible ^[30] and minimizing shared accounts ^[30], which translate into two questions for a provider: can each user have an individual login, and is two-factor available?

Retention is where documentation differs most

• Account-lifetime storage. Anytime Mailbox says its app stores mail for as long as the account remains active ^[8]; PostScan Mail says scanned contents are accessible while the account remains active ^[34]; iPostal1's privacy policy says personal information is stored throughout the life of the account ^[35].
• Permanent or unlimited framing. Traveling Mailbox describes storage providing a permanent record of mail items ^[6]; iPostal1 advertises unlimited free cloud storage for scans ^[36].
• Fixed physical holding windows. iPostal1 states 30 days of free storage for letters ^[27], PostScan Mail states the first 30 days are free with a daily fee afterwards ^[34], and Propulsio 360 states a one-month physical retention period for important and official documents ^[7].
• After termination. Anytime Mailbox stores mail received by the local operator for up to six months from termination ^[8]; PostScan Mail discards stored mail and holds received mail for six months ^[34]; Alliance Virtual Offices' terms say mail received after termination may be disposed of without notice ^[37].

Once the purposes for which information was collected are achieved, the statute requires destruction or anonymization, subject to any preservation period set by an Act ^[2], and the CAI says the only limit on that duty is a statutory retention period ^[4]. A customer should therefore ask whether scans can be deleted on request, how deletion reaches backups, and what happens to scans at contract end. An unlimited-storage feature should be matched with a customer-controlled retention schedule, and the CAI recommends that a business maintain a document-management procedure as the basis for destruction ^[4].

Subcontractors, platforms and locations

Swivl states that it scans mail into a private Google Drive accessible only by the customer ^[5]. PostScan Mail's encryption statement refers to a named cloud provider. iPostal1 directs mail-specific questions to the individual mail center ^[27], PostNet states that its locations are independently owned and operated and that services may vary ^[38], and Alliance Virtual Offices says it partners with other companies to provide limited services on its behalf ^[39]. Davinci's Montreal page says some facilities provide scanning and forwarding and that features vary by location ^[40].

These descriptions show that a "provider" may be a network of operators, and that the party opening a letter in Montreal may not be the party whose terms the customer signed. The OPC guidance asks organizations to confirm practices for destroying information at the end of its lifecycle ^[23], and the Cyber Centre lists destruction processes at the end of an outsourcing contract among the points to consider ^[30].

What certifications do and do not show

ISO describes ISO/IEC 27001 as defining requirements an information security management system must meet ^[41] and says organizations decide whether to seek certification ^[41]. It is a management system standard and does not by itself show how a specific envelope is handled. The AICPA's illustrative SOC 2 report includes tests of controls and results ^[42], so a buyer shown such a report should read its scope to see whether mail handling is included. No provider page reviewed stated an ISO or SOC certification, and none is assumed.

Shredding and proof of destruction

The CAI says the destruction method must suit the medium and confidentiality level ^[4], names cross-cut shredding as the preferred shredder type ^[4], and advises securing documents awaiting destruction until the vendor collects them ^[4]. The OPC says the goal is irreversible destruction so that information cannot be reconstructed ^[43] and that an organization contracting out disposal remains responsible ^[43]. NIST's media sanitization guidance (SP 800-88 Rev. 2) says the destroy method is appropriate for all hard copy ^[32]. The NAID AAA program owner states that audits cover chain of custody and employee background screening ^[44], and its manual leaves a smaller particle size to the data controller's discretion ^[45]. A stricter shred size is therefore a contract term to negotiate and not a default.

Provider statements on destruction are brief. Traveling Mailbox says mail is shredded on site ^[28]. PostNet lists forward, recycle, shred or pickup as options ^[38]. Propulsio 360 states shredding of incoming mail with no limit on quantities ^[7]. None of the pages reviewed described shred particle size, a destruction certificate for customers or an outside shredding vendor. Forwarding is usually priced: Regus's Montreal page says forwarding incurs additional charges ^[46], and a UPS Store Montreal page says additional fees may apply to holding and forwarding ^[47].

Provider Documentation Snapshot

Table 2 below summarizes what each provider's own pages say, as read on 27 October 2026. It is not a ranking or a complete feature list. Each cell reports only a statement found on the cited page, and "not stated" means the page reviewed was silent, not that the control is absent. Some operators are independent franchises or partner centers, so the local operator's contract governs. The publisher's row is included because it is a direct provider; its terms were not assessed here, so its cells ask for documents instead of describing features.

Three patterns emerge. Authorization language is the best-documented area, with several providers stating that opening happens on request or with consent. Retention and subcontractor information is the weakest, which is a documentation gap and not evidence of poor practice. And scope depends on the physical operator, so the Montreal location's contract matters more than a national brand page. Several rows draw on United States oriented pages (Form 1583, for example), so ask how authorization works for Quebec customers.

Incident Escalation, Exit and the Vendor Questionnaire

Incident escalation

The statute treats loss of personal information or any other breach of its protection as a confidentiality incident ^[2], and the CAI includes any access not authorized by law ^[17]. After an incident the enterprise must take reasonable measures to reduce the risk of injury and prevent new incidents ^[2]. If the incident presents a risk of serious injury, the CAI says the business must notify the Commission in writing ^[17], and these duties stay with the business when it entrusts information to third parties for keeping ^[17]. Every enterprise must keep a register of confidentiality incidents ^[2], including those with no risk of serious injury ^[17], for at least five years ^[17]. The customer therefore needs facts from the provider to complete its own register: what happened, when, which items, and which controls were involved. The contract should oblige the provider to supply them.

Exit and export plan

An exit plan covers the address, digital copies and physical mail. Revenu Québec says a business must notify it of a new address even if it signed up for Canada Post forwarding ^[15]. Canada Post's forwarding terms say it cannot forward mail addressed to those who receive mail through a shared postal address or privately administered mailboxes ^[52], so a buyer should not assume Canada Post forwarding will catch late mail after leaving a mailbox provider. For digital copies, the statute's guarantee that the provider does not keep information after the contract expires ^[2] translates into a request for an export file and written deletion confirmation. For physical mail, providers document post-termination holding of up to six months in some cases and disposal without notice in others ^[37], so record these terms before signing.

Printable vendor questionnaire

Record the answer, the document supplied and the date for each item.

1. Who legally operates the Montreal location, and is it the contracting party?
2. Which staff or subcontractors handle letters, and are they named?
3. What identification and written authorization do you require before accepting mail for the business?
4. Is opening off by default, and can it be authorized item by item and revoked?
5. Is each item logged with an identifier and timestamp at arrival, opening, scanning, forwarding and destruction, and can the customer see the log?
6. Who performs scans, and where are scan files hosted (country, platform, subcontractors)?
7. How are scans encrypted in transit and at rest, and are individual logins and two-factor authentication available?
8. How long are scans retained by default, and can the customer delete them on request, including backups?
9. How long is physical mail held, and what happens when the holding period ends?
10. What is the shredding method, who performs it, and does the customer receive a record or certificate?
11. Which categories of mail are refused (legal, government, banking), and how are they returned?
12. How are forwarded items packaged, tracked and signed for, and what are the charges?
13. Who may collect mail in person, and is collection logged with identification?
14. How and when will the provider notify the customer of a breach or attempted breach, and who is the contact?
15. Will the provider supply the details needed for the customer's own incident register?
16. Is there a named person in charge of personal information protection with published contact details? The CAI says the title and contact details of that person must be published ^[18].
17. What is the exit process: export of scans, deletion confirmation, and handling of mail received after termination?
18. Can you show a written contract covering confidentiality, security measures, no retention after the contract ends and breach notice?

Table 3 is a blank scorecard for three Montreal providers. Fill each cell with the evidence supplied (document name and date) and mark "not supplied" where nothing is provided.

A scorecard with many blank cells is itself a finding: either the provider has not documented a control or the buyer has not yet asked. Either way, sensitive mail should stay in the physical or exterior-only tier until the cells are filled.

Data Analysis and Evidence

The evidence here is mostly documentary, not statistical: statutes, regulator guidance, standards and provider terms. No public benchmark was found that measures how often mailbox providers open, scan or retain letters, and this report does not invent one. The quantitative material that exists falls into three groups.

Legal clocks.

• Incident register retention: at least five years under the CAI guidance ^[17], compared with two years for breach records under PIPEDA ^[53].
• Address change notice: Revenu Québec accepts notice up to 180 days in advance ^[15].

Provider retention windows (vendor statements read 27 October 2026).

• Fifteen or thirty days: physical mail holding at Domiciliation Montreal, by package (see Table 2).
• Thirty days: free storage periods described above at iPostal1 and PostScan Mail.
• One month and six months: the Propulsio 360 holding period and the post-termination holding at Anytime Mailbox and PostScan Mail described above.
• Account lifetime: digital storage at several providers, as described above.

Stated physical holding windows run from 15 days to six months, and digital retention is described in several places as lasting as long as the account does. A buyer who must satisfy the duty to destroy information once purposes are achieved ^[2] needs an explicit schedule, because an account-lifetime default is not a retention period chosen for the business's purposes.

Breach cost context. IBM's 2026 Cost of a Data Breach research, announced in Canada on 29 July 2026, puts the average Canadian breach cost at a record CA$7.11 million ^[9], names supply-chain compromise as the largest factor increasing costs in Canada ^[9], and is based on breaches at 602 organizations globally between March 2025 and February 2026 ^[9]. It covers breaches of all kinds, says nothing specific about paper mail or mailbox providers, and is no estimate for a small firm.

Implications and Future Directions

For buyers. The most valuable change is moving sensitive government and banking correspondence to online channels where possible. The online defaults described earlier ^[14] reduce sensitive paper. What remains, cheques and original notices, is the content that most deserves in-person collection or tracked forwarding. A small firm can often run two tiers: exterior-only handling and routine scanning for ordinary mail, and pickup for the rest.

For providers. The gaps in Table 2 are fixable: publishing retention periods, deletion rules, destruction methods and breach notice commitments would help customers meet their own duty to contract in writing ^[2].

For the publisher. As a direct provider of Montreal virtual offices and business addresses, the publisher is subject to the same questions. Readers should request its written contract, opening authorization, scan retention and destruction terms and compare them using the scorecard.

Open questions. Three items could not be answered from official sources: whether a commercial mailbox address is acceptable for each register or tax purpose, how the statute's consent concepts map to an opening authorization, and how cross-border scan hosting interacts with the impact assessment requirement in a specific case ^[2]. Each should go to the relevant authority or a lawyer, and the CAI and OPC pages should be rechecked before relying on this report after October 2026.

Frequently Asked Questions (FAQs)

Is a virtual mailbox private? An address can keep a home address off a letterhead, but the Quebec enterprise register is public and requires certain home addresses to be declared ^[1]. Contents are private only to the extent the provider's authorization, access and destruction controls hold, and the customer remains responsible for information it entrusts to others ^[3].

Who opens and scans my mail in a virtual mailbox? The provider's staff or a partner operator, according to each provider's pages. Some state opening only on request or with consent. Ask who the named handlers are and whether subcontractors are used ^[23].

What are the privacy risks of mail scanning? Exposure of contents to handlers, long retention of digital copies, hosting and subcontractors the customer cannot see, and weak access controls. The Cyber Centre recommends two-factor authentication ^[30].

What does virtual office mail handling in Montreal usually include? Pages reviewed describe receiving mail, notification, optional scanning, holding, forwarding and shredding, with variation and fees by provider and location ^[46].

What is mail scan custody? The recorded chain of who held an item and what was done to it from arrival to pickup or destruction. Table 1 maps it.

How long should scans and mail be kept? The statute requires destruction once purposes are achieved, subject to preservation periods set by an Act ^[2]. Set a schedule in the contract and do not accept an account-lifetime default.

Can a Montreal virtual address be used for tax authority mail? Agencies have their own address rules. The CRA does not allow post office boxes as a business address ^[12], and Revenu Québec expects an up-to-date address even when forwarding exists. Confirm with each agency.

Conclusion

A virtual mailbox in Montreal can protect an owner's home address from some audiences, but it does not make letter contents private by itself. Content privacy depends on a chain of custody that the customer can audit: who accepts the mail, who opens it, who sees the scan, how long copies persist, how paper is destroyed and how incidents are escalated. Quebec's framework places responsibility on the business that entrusts the information, and the guidance on written contracts and prompt breach notice indicates what the paperwork should contain.

Provider documentation reviewed is stronger on opening authorization than on retention, subcontractors and incident notice. That pattern supports a cautious method: classify mail, keep the most sensitive items in the physical pickup tier, authorize scanning item by item, and require written answers to the questionnaire before enabling content scans. The scorecard turns the answers into a comparison across three providers, including the publisher, without relying on assurances. Where a control cannot be documented, the conservative default is to collect sensitive mail in person and revisit the arrangement when the missing documents arrive.