Canadian data sovereignty, by construction.
Residency means your data is in Canada. Sovereignty means it is subject to Canadian law alone — and reachable by no other.
Residency is not sovereignty.
Most platforms advertising “Canadian data residency” are US-incorporated companies. The disk sits in Toronto or Montreal; the corporate parent sits in Delaware or California. That parent can be compelled by a US court under the CLOUD Act to disclose your data — regardless of where the disk lives.
The 2026 Canadian Technology Sovereignty Index found that roughly 80% of SaaS tools advertising Canadian data residency remain subject to US legal process. Only about one in five are both Canadian-resident and Canadian-owned.
Canner is in that minority — and built specifically for it.
What the CLOUD Act actually does.
The CLOUD Act — the Clarifying Lawful Overseas Use of Data Act, passed in 2018 — lets US federal authorities issue subpoenas, warrants, and disclosure orders to any company subject to US jurisdiction. That generally means any company incorporated in the United States, with substantial US operations, or owned by a US parent. The physical location of the data is not a defence.
There is no US-Canada CLOUD Act executive agreement in force. Negotiations have been stalled for more than three years. A US-UK agreement does exist — and a 2025 disclosure revealed that the UK had used it to secretly demand a global encryption backdoor from a major US technology vendor.
Canadian legal commentary in 2025–2026 has converged on a clear rule: an entity incorporated and managed wholly in Canada generally falls outside the CLOUD Act’s reach. A Canadian subsidiary of a US parent does not.
How Canner is structured.
Sovereignty has to be designed in at the company level, not the data-centre level. Here is what that looks like for Canner:
Canadian ownership
Canner is 100% Canadian-owned and operates from Quebec. No US parent. No US affiliate. No foreign investor.
Canadian operation, Canadian personnel
All personnel are in Canada. Payment processing, support, and operations are governed by Canadian and Quebec law.
Hosted in Quebec on Canadian infrastructure
Compute, storage, and tenant databases run on Web Hosting Canada VPS instances in Montreal, on the Hydro-Québec grid — over 99% renewable energy.
No foreign network transit by default
Cloudflare handles DNS and TLS certificate issuance only — no traffic proxying, no edge caching. Your application’s requests do not transit a US edge network in normal operation.
Where this matters — by audience.
If you are in Quebec
Quebec’s Law 25 reached full force in September 2024. Administrative fines reach CA$10 million or 2% of global turnover; penal fines reach CA$25 million or 4%. Article 17 of the Act requires a Privacy Impact Assessment before transferring personal information outside Quebec. Hosting on Canner satisfies that default by keeping data in Quebec.
If you are elsewhere in Canada
PIPEDA at the federal level, BC PIPA, Alberta PIPA, and Ontario’s PHIPA (for health information) all apply concurrently. The same architecture that satisfies Law 25 satisfies these regimes by construction — a Canadian-resident, Canadian-controlled platform avoids the cross-border accountability problems that anchor most provincial guidance.
If you sell to government or regulated sectors
Canada’s Buy Canadian procurement policy came into force in December 2025; by April 2026, roughly CA$527 million had been awarded to Canadian-controlled suppliers. The Government of Canada’s 2024 Digital Sovereignty Framework treats supplier nationality as a first-class procurement criterion. Canner answers “not subject to the CLOUD Act” affirmatively in writing.
Sovereignty vocabulary, briefly.
- Data residency
- The requirement that personal information be stored on physical media located within a specific jurisdiction (for example, Canada). Necessary but not sufficient for sovereignty.
- Data sovereignty
- The condition in which personal information is subject only to the laws of the jurisdiction where it resides — and not to any foreign legal process. Requires the operating entity to itself be local.
- US CLOUD Act
- The Clarifying Lawful Overseas Use of Data Act (2018). Authorises US federal authorities to compel disclosure from any company subject to US jurisdiction, regardless of where the data is stored.
- PIPEDA
- The Personal Information Protection and Electronic Documents Act (federal, Canada). Governs how private-sector organisations collect, use, and disclose personal information.
- Quebec Law 25
- An Act to modernize legislative provisions as regards the protection of personal information (LQ 2021, c. 25). The strictest private-sector privacy regime in Canada.
- Privacy Impact Assessment (PIA)
- A formal evaluation that a personal-information transfer or new processing activity satisfies the relevant legal regime. Required under Law 25 Article 17 for transfers outside Quebec.
Your data stays Canadian.
Free tier available. No credit card required to start on Starter.