Data residency vs data sovereignty: where the disk is, and whose law reaches it.

The Government of Canada’s white paper on data sovereignty and public cloud uses short definitions. Data residency is “the physical or geographical location of an organization’s digital information.” Data sovereignty is “Canada’s right to control access to and disclosure of its digital information.”

The same paper then says the part most vendor pages leave out. Data residency “does not mitigate against the application of foreign laws”, and “as long as a CSP that operates in Canada is subject to the laws of a foreign country”, Canada “cannot ensure full sovereignty over its data”. That is the federal government describing its own cloud use, not a vendor’s pitch.

For a buyer, it helps to split the question in three: where the data is (location), which courts can order the provider to produce it (jurisdiction), and who runs the systems and holds the keys (operator). Residency answers only the first.

Each row is a common hosting setup. The last column is our reading of section 17 of Quebec’s private-sector privacy Act, for the hosting only; the Law 25 guide covers it in full.

The US CLOUD Act added section 2713 to title 18 of the US Code in 2018. It says a provider of electronic communication or remote computing service must disclose data “within such provider’s possession, custody, or control, regardless of whether such communication, record, or other information is located within or outside of the United States.”

The test is control, not location. A US-incorporated cloud controls the disks in its Montréal region as much as the ones in Virginia, so picking ca-central-1 changes where the data sits and nothing about who can be ordered to produce it. That is our reading of the statute; it has not been tested in a Canadian case that we know of.

A treaty could change how those orders reach Canada. The US and Canada announced negotiations on a CLOUD Act agreement in March 2022. No agreement had been announced as of October 2026; the US Justice Department lists signed agreements with the UK and Australia only.

Few Canadian rules require data to stay in Canada. Most ask you to assess, contract and disclose. Here is what the primary texts say.

Residency is not worthless. It is necessary for sovereignty, and on its own it does a few real things:

• Quebec location takes section 17 off the hosting. A Montréal or Quebec City region, on any provider, means the hosting itself is not a communication outside Quebec. Backups and replicas elsewhere still count.
• It meets the federal “principal delivery option” for Protected B workloads, which is a location test, not an ownership test.
• Latency. A Montréal server answers users in Quebec and Ontario faster than one in Virginia or Oregon.

Ask each provider these questions in writing, and keep the answers with your privacy impact assessment.

• Where is every copy? The primary database, backups, replicas, logs, error reports and support exports. Residency claims often cover the first one only.
• Who owns the provider, all the way up? If a Canadian company has a US parent, ask whether the parent could be ordered to produce what the subsidiary holds. That is the question the “control” test in § 2713 raises.
• Where are support and operations staff? Whether remote access from outside Quebec is a communication outside Quebec has not been settled by the Commission d’accès à l’information. Record the answer either way.
• Which subprocessors touch your data, and what do they hold? Ask for the list and what each one sees. Canner’s: GloboTech for hosting (Montréal data centre), WHC and OVH (former hosts being wound down, now only forwarding traffic), Cloudflare for DNS records and certificates only (no traffic passes through it), Stripe for payments, Resend for account emails, GitHub when you connect a repository, Dynadot for domains you register through Canner, and Google or Microsoft if you sign in with them.
• Will they sign the contract section 18.3 requires? A written mandate with confidentiality measures, use only for the service, deletion at the end, and breach notice without delay.
• Where do your own integrations send data? Analytics, email, error tracking and AI APIs are often the copies that leave the country. They count as much as the host does.
• Can you leave? Standard Postgres dumps and S3-compatible storage make an exit plan real.

Canner’s servers are in Montréal. Your apps, databases, files and their backups are stored there, the platform is operated from Quebec, and the company is Canadian-owned with no US parent. For your assessment, the Compliance add-on ($29/mo) adds a signed data processing agreement, a data-residency attestation and the organization audit log. See pricing.

Off-site backup copies go to a bucket you choose, so you decide whether that copy stays in Quebec (database docs).

Canner runs in one region with no automatic failover. If you need a second province for disaster recovery, or multi-region high availability, a hyperscaler’s Canadian regions do that and Canner does not. Do the section 17 assessment for the second region and weigh the US exposure in it.