Postgres for regulated Canadian workloads.

Quebec’s Law 25 and the federal PIPEDA put obligations on organizations that collect and use personal information. Those obligations stay with you. A hosting provider cannot make you compliant. What it can do is avoid making your job harder: keep the data in Canada, be clear about who has access, give you working controls over retention and deletion, and sign a data processing agreement.

Canner’s part of that is the infrastructure: Postgres databases, backups and a recovery archive on servers in Quebec, run by a Canadian company. We do not give legal advice, and this page is not a compliance opinion. Ask your own counsel what your obligations are.

• Residency: the data is stored in Montreal, Quebec. It is Canner’s only region.
• Processor terms: a signed DPA and a Quebec residency attestation are included on Studio, and available à la carte on Starter and Live. Enterprise adds a custom DPA and a Law 25 privacy-impact-assessment support pack.
• Subprocessors: a subprocessor register with change notifications is part of Enterprise.

Hosting data in a Canadian city is residency. Sovereignty is about whose laws can reach it. The Government of Canada’s own white paper on data sovereignty in the public cloud says data stored in the cloud “may be subject to the laws of other countries”, and it names the ability of the United States to compel a US-law organization to hand over data “regardless of the data’s location”. So a US-incorporated provider with a Canadian region still has that exposure, whatever region you pick.

Canner is Canadian-owned with no US affiliate and hosts only in Montreal, so it is not subject to the US CLOUD Act. The sovereignty page explains what that means and where it stops.

You set how long backups are kept and how often they run, per database. Every plan has scheduled and manual backups, backup verification, and email alerts when one fails or cannot be verified.

On the dedicated instance (CA$9 a month per project), point-in-time recovery lets you choose a recovery window of 1 to 35 days and restore to any moment inside it, into a new database. That helps when you need to show what a record looked like at a given time, or to undo an error before it spreads. Anything older than your window is dropped for good, which is also the point when a policy says data must not be kept longer.

• Restores never overwrite silently: recovery lands in a new database, and replacing the original takes a snapshot first.
• “Inspect first” restores into a temporary database that deletes itself after 24 hours unless you keep it, so a test restore leaves nothing behind.
• Backups count toward your storage pool, and you get alerts at 80, 95 and 100%.

Backups are encrypted at rest with a key for each backup. When a backup is deleted, including by retention, its key is destroyed, so any copy that lingers is permanently unreadable. That is crypto-shredding, and it also applies to the copy sent to your own off-site bucket: deleting the backup makes the copy unreadable even if the remote delete has to be retried.

On the dedicated instance the recovery archive (base backups and WAL) is compressed and encrypted with AES-256 before it is written, with a key unique to your instance. Removing the instance removes the key. An optional encrypted off-site copy of the archive goes to a bucket you own. Canner keeps the key, so the bucket alone cannot be read.

This protects the backup and archive files. It is not disk encryption of the whole server, and you should say that accurately in your own documentation.

The organization audit log is an append-only record of meaningful actions: deploys, member and permission changes, domain and billing changes, each with actor, target and timestamp. Entries cannot be edited or deleted. It is included on Studio and Enterprise, retained for 13 months and exportable. It records platform actions. It does not record individual SQL statements.

For database access, you have several layers:

• Named read-only and read-write roles with their own connection strings, up to 10 per database.
• External access is off unless you turn it on, then TLS-only with an IP allowlist.
• Members hold per-area and per-project View or Edit permissions, enforced across the dashboard, the API, MCP and the CLI. Studio includes 25 seats.
• Changes from an inbound subscription are applied with your table owner’s rights, never as a superuser.
• On the dedicated instance, logs and query insights are scoped to the database you are looking at. Note that log lines can contain the text of slow and failing statements, including literal values, so treat that log as sensitive.

We make no HIPAA or PCI-DSS claims for Canner Postgres. If your data or your contract requires them, Canner is not the right place for it today. We would rather say so now than have you find out during a review.

There is also no automatic failover or multi-zone high availability. Canner runs in a single region on a single provider, so plan for that in your availability and continuity documents: the protection against losing a server is backups, the recovery archive and the off-site copies you set up. Enterprise carries a 99.9% uptime commitment with service credits, and an annual security review. If a specific attestation matters to you, ask us for what exists before you decide.