Resources/Canadian data sovereignty

Twelve questions to ask a vendor about where your data lives

Reviewed September 1, 2026

Most vendor security pages answer the questions the vendor finds flattering. These are the twelve that decide who can compel your clients' documents, in the order that matters. Send them as they are; the quality of the answers will sort the field quickly.

Ownership and jurisdiction

Who owns and operates the company that holds the data, and in which country is it incorporated?
Which entity operates the physical servers: you, or a hyperscaler you resell?
Are you subject to the legal process of any country other than the one where the data sits?

Question 2 catches the common case. A vendor can be Canadian and still hold everything in a US-owned cloud, in which case the US-owned cloud is the one with custody, and the vendor's incorporation certificate does not change that.

Where the copies are

Where do backups live, in whose facility, and under whose control?
Is there any replication, failover, or disaster-recovery copy outside the country?
Where do logs, analytics, and error reports go, and do they contain customer content or file names?

Copies are where residency claims usually break. Primary storage is the part vendors have thought about; the backup target and the observability pipeline are the parts they have not.

Who can see it

Which subprocessors touch the data, and where is each of them?
Which of your staff can access customer data, from which countries, under what controls, and is that access logged?
What is encrypted, in transit and at rest, and who holds the keys?

Question 8 is the one that gets hand-waved. A support engineer with production access is a real access path, no matter how good the encryption story is.

Email, the question almost everyone gets wrong

When your system emails my client a link or a notification, which providers relay that message, and where are they?

Notification email crosses borders routinely, even for vendors whose file storage genuinely does not. A vendor who volunteers this distinction without being pushed is usually being straight with you about the rest of the list. A vendor who has never considered it has not thought about jurisdiction as carefully as their marketing page suggests.

Process and change

What is your policy when you receive legal process for customer data: do you notify the customer, do you require a warrant, do you publish a transparency report?
What happens to the answers above if you are acquired?

Question 12 is not hypothetical. A Canadian vendor acquired by a US parent becomes a US-controlled vendor on closing day, and the custody chain your assessment relied on changes without your file moving an inch. Ask what notice you would get, and what your exit looks like.

Reading the answers

You are not looking for perfect answers. You are looking for specific ones. "Our servers are in Canada" is a slogan; "the application, the database, and object storage run on hardware owned by a Canadian company in Toronto, backups go to a Canadian facility we operate, and our notification email currently relays through a provider outside the country" is a vendor who has done the work and will tell you where the seams are.

Keep the answers. If you are subject to Quebec's Law 25, they are most of your privacy impact assessment. If you are a lawyer, they are most of your due-diligence record. Either way, they are what you will want on hand the day a client asks.