What “data stored in Canada” really means — and 7 questions to ask a vendor
Why Canadian businesses ask for it
- Clients and patients expect it, and it's easy to explain.
- Some laws and contracts require or strongly prefer it — for example Québec's Law 25 asks for a privacy impact assessment before personal information is communicated outside Québec, and many public-sector and health contracts set residency terms.
- It keeps your data under Canadian law in the first instance.
What it covers — and what it doesn't
| Usually in scope | Often overlooked |
|---|---|
| Uploaded files and form answers | Backups and disaster-recovery copies |
| The database of records | Email and text delivery (the recipient's provider may be anywhere) |
| Staff logins | Support, analytics and error-tracking tools |
| Encryption keys | The vendor's company and parent company location |
A US-headquartered cloud provider can host data in Canada; the data is stored in Canada, but the provider is still a US company. An honest vendor says exactly that rather than promising the data never crosses the border.
7 questions to ask any vendor
- Which region or data centre stores our data, and can the service run anywhere else?
- Are backups kept in Canada too, and for how long?
- Which subprocessors handle our data, and where?
- What leaves Canada at all (email or text delivery, certificates, support tools)?
- Who holds the encryption keys?
- Who on your team can access our clients' information?
- Will you put residency and deletion in a signed agreement?
How SealDrop answers them
Every record, file, answer and login lives in Amazon Web Services' Montréal region, and the service is set up so it can't be deployed anywhere else. Emails and texts pass through the recipient's own provider, so they carry nothing sensitive. The web certificate for our addresses (domain names only) is issued in AWS's US East region, as CloudFront requires. Details: security and privacy.
General information for Canadian businesses, not legal advice. Laws and professional rules change — check the current version with your regulator or lawyer.
Questions
Does Canadian data residency mean data never crosses the border?
Not necessarily. Emails and texts pass through the recipient’s own provider, and some vendors keep backups or tools elsewhere. Ask what, if anything, leaves Canada.