Systems Integration near you

Start with the flows rather than the tools. For each one, the integrator should be able to state which system is authoritative for a record, in which direction data moves, how often, what happens when the same record is edited in both places, and what a failure looks like to a person. Writing that down usually surfaces a disagreement about which system is the source of truth, and that disagreement is cheaper to settle now.

Then comes field mapping and the unglamorous edge cases: what happens to a partial refund, a cancelled job, a record with a missing required field, a duplicate. Ask specifically about error handling and retries, and about whether a failed record is queued and surfaced or silently dropped, because silently dropped is the default in a surprising amount of hastily built integration work.

Build and test in a sandbox against realistic data, not a handful of clean examples. Agree a cutover plan that covers what happens to records created during the switch, and define monitoring before go-live: someone must be alerted when a sync stops, and that someone has to still work at your business after the integrator leaves.

Every connection is a grant of access, and the damage a compromise can do is decided by how generously that grant was made. The Cyber Centre's baseline controls tell small and medium organizations to give accounts the minimum functionality necessary for their tasks, to keep administrative accounts for administrative activity rather than everyday use, to remove accounts when they are no longer needed, and to use two-factor authentication wherever possible, including on cloud administration accounts.

Applied to integration work, that means a few concrete questions. Is the connection using a dedicated service account, or somebody's personal login that will break and be over-permissioned the moment they leave? Is the API scope limited to the records the integration actually needs, or is it full account access because that was quicker? The Cyber Centre's website security guidance is explicit that database credentials and API keys are not to be hardcoded and should be referenced at run time from a separate environment, which rules out the common shortcut of leaving a key in a script or a configuration file in a repository.

Blast radius also extends beyond your own walls. The Cyber Centre's software supply chain guidance warns that a single upstream compromise can be used to pivot into many downstream client networks, and states plainly that your organisation is legally responsible for protecting its information even when you are using third-party services. That legal point lines up with the federal private-sector privacy law, under which an organisation remains responsible for personal information transferred to a third party for processing.

Nobody is licensed to perform systems integration in Canada. There is no registration, no protected title and no disciplinary body, so the usual advice to check a public register does not apply here. What exists instead is a published government baseline you can hold a proposal against.

The Canadian Centre for Cyber Security publishes baseline cyber security controls aimed specifically at small and medium organizations, covering least privilege, administrative account separation, two-factor authentication, password policy, secure handling of portable media, and the handling of outsourced and cloud IT providers, including evaluating a provider's data handling practices and the jurisdictions involved. Reading the relevant sections before you take proposals lets you ask specific questions rather than general ones.

A useful test of an integrator is how they react to those questions. Someone who can explain why they are asking for a particular scope, and who volunteers a narrower option, is a different proposition from someone who asks for an administrator login on the first call because it makes their work easier.

Decide in advance who is called when an integration fails, because the useful window is short. A broken sync that goes unnoticed for a week produces two systems that disagree, and reconciling them by hand is far more work than fixing the connection. Your contract should say what response you can expect and whether support continues after the project closes.

A vendor breach is the harder case, because the failure is not in your systems. The Cyber Centre's supply chain guidance for small and medium organizations recommends adding contract clauses requiring suppliers to notify your organisation of security incidents and vulnerabilities within a specified time frame, which only helps if it was negotiated before you needed it. Know in advance which credentials and scopes each connected vendor holds, so that revoking them is a decision you can make in minutes.

Where personal information is involved, the federal private-sector law contains obligations dealing with breaches of security safeguards, and businesses in Quebec must report confidentiality incidents presenting a risk of serious injury to the Commission d'accès à l'information and keep a register of them. Those obligations sit with your business, not with the integrator, which is another reason to know exactly what data each connection moves.

An undocumented integration is the classic way a business ends up locked to one supplier. Nothing is withheld deliberately; the knowledge simply never left one person's head, and the next firm quotes high because they have to reverse-engineer it before they can touch it. The fix is to specify the documentation as a deliverable with the same weight as the working code.

A reasonable handover package names every system involved and its owner, lists every credential and service account created and what scope each has, records the field mapping and the transformation rules, describes error handling and where failures surface, states the schedule and any dependencies, and explains how to run and redeploy the thing. If custom code was written, it should be in a repository your business controls, with a licence or assignment in the contract that makes clear it is yours.

LokalMatch works by request for integration projects: you describe the systems you want connected and what should flow between them, and integrators who cover your area contact you to discuss it. LokalMatch does not assess anyone's security practices, does not verify claims about certifications or vendor partnerships, and does not rank or recommend firms, so compare proposals on the questions above and treat a refusal to document the work as a reason to keep looking.