Data hosting in Canada: how to check that a provider is truly sovereign

“Data hosted in Canada.” The line appears on almost every cloud provider’s website, the largest included. It is accurate, and it answers the wrong question. Knowing where the servers are tells you about data residency. Knowing which law applies to whoever controls them tells you about data sovereignty.

The Government of Canada makes the same distinction in its white paper on data sovereignty and public cloud. It states that as long as a cloud service provider operating in Canada is subject to the laws of a foreign country, Canada will not have full sovereignty over its data, and that data residency does not mitigate against the application of foreign laws, regardless of where the cloud resources are physically located.

A more recent paper prepared for the Treasury Board, reported by The Canadian Press in November 2025, goes further: storing data in Canada, or even using a Canadian supplier, would not guarantee that foreign courts would not have jurisdiction. Hence the need to check rather than trust a label.

On June 10, 2025, before a French Senate inquiry on public procurement, Microsoft France’s legal director, Anton Carniaux, was asked whether he could guarantee that French citizens’ data hosted by Microsoft would never be handed to U.S. authorities without the agreement of French authorities. He answered that he could not guarantee it, while adding, according to published accounts, that no such request had occurred so far.

That answer says nothing bad about Microsoft: it is an honest description of U.S. law. Our article on the CLOUD Act explains why a U.S.-owned company must hand over data in its possession, custody or control, even when it is stored outside the United States. The federal white paper also names the U.S. Foreign Intelligence Surveillance Act (FISA) as the primary risk.

This is the list we use to assess a hosting provider. None of it requires a law degree. All of it requires answers in writing.

In Quebec, these checks are more than good practice. Before communicating personal information outside Quebec, section 17 of the Act respecting the protection of personal information in the private sector requires an assessment that considers, among other things, the legal framework in the destination state, and the communication must be governed by a written agreement.

Answers to the ten questions above are the raw material for that assessment, and for the privacy impact assessment required for any information system project involving personal information. A provider that cannot answer them in writing leaves you with an empty compliance file.

Once you have the answers, the ranking is straightforward. A server on your own premises remains the top tier. Next comes a Canadian-owned host running its own data centres in Quebec with no foreign subcontractor in the chain. A non-U.S. foreign host operating in Canada sits one step lower: outside U.S. jurisdiction, but outside Canadian jurisdiction too. The Canadian region of a U.S. hyperscaler offers residency, not sovereignty.

This ranking condemns no provider. For low-sensitivity data, a large provider’s Canadian region can be a reasonable, documented choice. For patient records, trade secrets or information protected by professional secrecy, the analysis changes.

Our AI agents are hosted on the client’s premises or in the client’s region, with a provider whose ownership chain we have checked against the list above. That is what we mean by sovereign AI: a model and data that answer to a law you know, and written answers to prove it.

To see how we build these architectures, visit our home page or send us the list of your current providers: we will tell you which ones deserve a second look.