UNDERSTANDING DATA SOVEREIGNTY
Data Residency
Geographic location where data is physically stored.
Example: Data stored in AWS Canada region (Montreal)
Physical location is Canada
Data Sovereignty
Legal jurisdiction governing data access and control.
Example: AWS is US company subject to US CLOUD Act
Legal jurisdiction is United States, even for data in Canada
The CLOUD Act
Clarifying Lawful Overseas Use of Data (CLOUD) Act allows US government to compel US companies to produce data, regardless of where data is stored globally.
The Problem:
Data residency in Canada doesn’t provide sovereignty if your provider is US-owned.
What this means:
AWS Canada region data accessible to US government
Microsoft Azure Canada data accessible to US government
Google Cloud Montreal data accessible to US government
Any US company, any datacenter location worldwide
Why it matters:
US law applies to Canadian data if stored with US provider
No notification to Canadian data subject when US government accesses
Potential conflict with Canadian privacy laws (PIPEDA)
Canadian legal protections don’t apply
Canadian Hosting Hierarchy
Tier 1 (Strongest Sovereignty)
- Canadian-owned providers with Canadian datacenters
- Web Hosting Canada
- ThinkOn (sovereign cloud, government-certified)
- Server Cloud Canada
- CACloud
- CanSpace Solutions
Tier 2 (Non-US Sovereignty)
- Non-US providers with Canadian datacenters
- OVHcloud Canada (French company, Canadian datacenter)
- Provides Canadian residency and non-US sovereignty
Tier 3 (Residency Only)
- US providers with Canadian datacenters
- AWS Canada (Montreal region)
- Microsoft Azure Canada
- Google Cloud Montreal
- Canadian residency, US legal jurisdiction (CLOUD Act applies)
Tier 4 (Neither Residency Nor Sovereignty)
- US providers with US datacenters
- AWS US regions
- Microsoft Azure US regions
- Google Cloud US regions
Stay Sovereign, Stay Safe
Let the experts at Orchard worry about where and how your data is hosted and protected while you tend to your business.
Whether it’s a sovereignty assessment, procuring a new service provider, dealing with data governance, bidding on a government contract or migrating to different cloud services, we’re here to help.