Canadian data sovereignty, by construction.
Residency means the data is in Canada. Sovereignty means it's subject to Canadian law alone. The distinction is small, but important in a world where foreign powers are increasingly demanding the data of foreign citizens.
Residency is not sovereignty.
Most platforms that offer Canadian data residency are US tech oligarchs. The disk is in Toronto, but the company itself is legally obliged to US law, meaning your data is subject to seizure at its discretion.
The 2026 Canadian Technology Sovereignty Index found that roughly 80% of SaaS tools with Canadian data residency were fully subject to the US CLOUD Act. Canner is in that 20%, and built to remain there.
What the CLOUD Act actually does.
The CLOUD Act (Clarifying Lawful Overseas Use of Data Act) was passed in 2018. It allows US federal authorities to issue warrants and disclosure orders to any company subject to US law for access to their overseas data holdings. Basically, it states that housing data outside the US does not clear a company from serving it to officials. This extends to foreign-owned data and data on foreign nationals.
The end result is that any data hosted by an American company could be accessed by US officials at the discretion of US law, regardless of who owns the data or where it is physically located.
How Canner is structured.
Sovereignty is structural. It's not a "position," it's a fact.
Ownership
Canner Inc. is 100% Canadian-owned and operates from Quebec. We have no US parent, affiliate, entity, or investor. Shares are 100% held by a natural Canadian citizen.
Operation
All personnel are in Canada, and our operations are governed by Canadian and Quebec law alone.
Infrastructure
Compute, storage, and processing run on Canadian-owned and Canadian-controlled infrastructure.
No foreign network transit
Canner doesn't proxy traffic or use edge caching. So even data exposed in customer dashboards or report generation doesn't transit the US edge network, and isn't stored in caches unless intentionally accessed from the US.
Where this matters — by audience.
If you are in Quebec
Quebec's Law 25 was activated September 2024. Fines of $10M or 2% global turnover are real. Penal fines of $25M or 4% are active. The only actual requirement is that a Privacy Impact Assessment must be performed before transferring personal information outside Quebec. Hosting on Canner sidesteps this problem, because everything that goes into it never actually leaves Canada.
If you are elsewhere in Canada
PIPEDA, BC PIPA, Alberta PIPA, Ontario's PHIPA all apply. The same logic applies here. Rather than trying to justify using American data centers, we just do it ourselves and bypass the data transit problem entirely.
If you sell to government or regulated sectors
In August 2025, Shared Services Canada issued a request for information for a fully sovereign public cloud. Canada's Buy Canadian procurement policy came into force in December 2025. The Government of Canada's 2024 Digital Sovereignty Framework treats supplier nationality as a premier procurement criterion. Canner isn't just built to combat the CLOUD Act. We are the definitive sovereign cloud stack.
Sovereignty vocabulary, briefly.
- Data residency
- The requirement that personal information be stored on physical media located within a specific jurisdiction (for example, Canada). Necessary but not sufficient for sovereignty.
- Data sovereignty
- The condition in which personal information is subject only to the laws of the jurisdiction where it resides — and not to any foreign legal process. Requires the operating entity to itself be local.
- US CLOUD Act
- The Clarifying Lawful Overseas Use of Data Act (2018). Authorises US federal authorities to compel disclosure from any company subject to US jurisdiction, regardless of where the data is stored.
- PIPEDA
- The Personal Information Protection and Electronic Documents Act (federal, Canada). Governs how private-sector organisations collect, use, and disclose personal information.
- Quebec Law 25
- An Act to modernize legislative provisions as regards the protection of personal information (LQ 2021, c. 25). The strictest private-sector privacy regime in Canada.
- Privacy Impact Assessment (PIA)
- A formal evaluation that a personal-information transfer or new processing activity satisfies the relevant legal regime. Required under Law 25 Article 17 for transfers outside Quebec.
Questions developers and compliance teams ask.
- Is Canner subject to the US CLOUD Act?
- No. Canner is 100% Canadian-owned and operated, with no US parent, affiliate, or legal nexus. Your data is governed by Canadian law alone — PIPEDA federally and Law 25 in Quebec.
- If Canner is sovereign, why does payment run through Stripe (a US company)?
- Your hosted data — apps, databases, files — stays in Quebec on Canadian infrastructure, under Canadian law. A few narrow, ancillary services use non-Canadian vendors, and none of them touch your application data: Stripe processes card and billing details to take payment; Cloudflare issues TLS certificates and holds DNS records only (no traffic or data proxies through it); and outbound account email — verification, receipts — is sent via Resend, which sees the recipient address, not your data. Sovereignty is about where your data lives and which law governs it: Quebec, under PIPEDA and Law 25.
- Is a Canadian AWS region enough for Law 25 compliance?
- Not on its own. A Canadian region of a US-owned provider keeps data in Canada but leaves it under US jurisdiction via the CLOUD Act, which still triggers a Transfer Impact Assessment under Law 25. Canner removes that exposure because the company itself is Canadian.
- Does Canner sign a Data Processing Agreement?
- Yes. A DPA built for PIPEDA and Quebec’s Law 25 comes with the Compliance add-on ($29/mo) on any paid plan, and with Enterprise.
- Can you provide a residency attestation for my Privacy Impact Assessment?
- Yes. We provide a signed statement of where your data lives and which laws govern it, suitable to attach to a PIA under PIPEDA or Quebec’s Law 25 — included in the Compliance add-on ($29/mo), and with Enterprise.
- Do you support Law 25 Transfer Impact Assessments?
- Because Canner has no US nexus, hosting with us avoids the cross-border transfer that triggers a TIA in the first place. We supply the residency attestation and DPA to document it.
Your data stays Canadian.
Free tier available. No credit card required to start on Starter.