Canadian data residency on AWS, Azure, and GCP

Customers, auditors, and public-sector contracts often ask a plain question: where does this data live, and who can reach it? Choosing a Canadian region is only part of the answer. Backups, logs, encryption keys, and admin access each have their own location and settings, and they don't always follow the workload. We help you choose where workloads should run, move them there, and set up and document the controls that keep data where you intend.

Book a consult

Who needs Canadian data residency

For most private-sector organizations, the need to keep data in Canada doesn't come from federal privacy law. It usually comes from a customer contract, a public-sector buyer, a sector regulator, a provincial rule that applies to you, or your own policy. Knowing which one applies tells you what you have to show, and that shapes the work.

This work fits when someone needs a clear, written answer about where your data is stored. A contract or RFP (request for proposal) may ask for Canadian storage. A privacy or security team may need to explain your setup to a customer. You may have already moved to a Canadian region and want to check that backups, logs, and copies came along. You may be planning a new workload and want residency built in from the start.

We don't give legal advice, and we don't host your data. Your legal or privacy team decides what a law or contract means for your organization. We give them an accurate technical picture to work from, and we build what they decide.

What we do

Choose where workloads run. AWS, Azure, and GCP each have Canadian regions, and some teams look at a Canada-based provider instead. We compare the options against what you need to run. Not every managed service is offered in every region, so we check the services you use against each option before you commit.

Move workloads and data. We plan and carry out the move of applications, databases, and stored files into the chosen region. Cutover is sequenced around your team's capacity, with a rollback path at each step.

Set up residency controls. We set up the controls that keep data in place: policies that restrict which regions can be used, encryption keys you manage, backup and replica locations, where logs and monitoring data are stored, and who has administrative and support access. Each control is documented so your team can show how it is configured.

Map controls to your requirements. We map each control to the requirements you name. These may include federal privacy law for the private sector (PIPEDA, the Personal Information Protection and Electronic Documents Act), provincial privacy laws where they apply, sector rules, and public-sector contract terms. The result is a plain document your legal, privacy, or procurement team can review. We don't give a legal sign-off. The requirements are yours to interpret, and the controls are ours to set up and explain.

Keep cost in check. A region move changes your bill, through duplicated backups, data transfer, or services priced differently by region. We estimate the effect from your current bill using each provider's published pricing, then design to avoid cost you don't need. For broader spend work, see cloud cost optimization.

How a Canadian data residency review runs

It starts with a Canadian data residency review. This is a fixed-scope engagement with a written result. We look at where your data, backups, logs, and keys live today, and who can reach them. We compare that with the requirements you bring. You receive a findings report: what is already in Canada, what isn't, which gaps matter most, a recommended target region or provider, and an outline of the move.

Implementation is optional. If you want help acting on the review, we agree a separate scope for the move and the controls. Your own team can also run the plan, or you can bring in another firm. The review is written so it stands on its own.

You leave with records your team can maintain. Every engagement ends with configuration notes, a control map, and runbooks your operators can keep current as the system changes. For how engagements start and who leads them, see About.

Canadian data residency requirements: common questions

Does Canada have data residency requirements?: There is no single Canada-wide rule that all data must stay in the country. Federal privacy law for the private sector (PIPEDA) allows personal information to be processed outside Canada, as long as the organization stays accountable for it. Some public-sector bodies, sector regulators, and buyers do set rules about where data is stored or how out-of-country storage is assessed. Contracts often add their own terms. Your legal or privacy team decides which of these apply to you. We help you show how your systems meet them.
Does PIPEDA require data to be stored in Canada?: No. According to the Office of the Privacy Commissioner of Canada, PIPEDA does not prohibit transferring personal information outside Canada for processing. The organization remains accountable for it. It must use contracts or other means to give the information comparable protection. It must also tell people their information may be processed in another country and may be accessible to authorities there. Other rules or contracts may still apply, and your legal or privacy team should confirm your obligations.
What is the difference between data residency and data sovereignty?: Data residency is about where data is stored and processed. Data sovereignty is usually about which laws apply to data and who can be required to disclose it. A Canadian region answers the first question. It does not settle the second on its own, because a provider can be subject to laws that require disclosure wherever the data is stored. We document the location and access facts. Your legal or privacy team assesses what they mean.
Which AWS, Azure, and GCP regions are in Canada?: AWS has Canada (Central), ca-central-1, in the Montréal area, and Canada West (Calgary), ca-west-1. Azure has Canada Central in Toronto and Canada East in Québec City. Microsoft describes the pair as supporting in-country data residency, failover, and disaster recovery for Azure core services. Google Cloud has northamerica-northeast1 in Montréal and northamerica-northeast2 in Toronto. Not every service is offered in every region, so we check the services you use against each one.
Do backups, logs, and support access count?: In our reviews, yes. Production data is only part of the picture. Backups, replicas, logs, monitoring data, and the paths administrators and vendor support use to reach a system can each sit in a different place. We list each one, note where it lives and who can reach it, and change the settings where the platform allows.
Do Microsoft 365, AI assistants, and other SaaS tools keep data in Canada?: It depends on the product, the plan, and the settings, and vendors update these. We don't assume. During the review we check each tool's current vendor documentation, link it, and note what it covers and what it doesn't.
Is there a Canadian cloud provider, and should we use one instead of AWS, Azure, or GCP?: There are Canada-based providers as well as the Canadian regions of AWS, Azure, and GCP. Which fits depends on the requirement you have to meet and the services the workload needs. We compare the options for your case. We don't rank providers.
What does moving to a Canadian region cost?: It depends on your services and how they are set up. We estimate it from your current bill using each provider's published pricing, and the review shows the result for your estate. We don't publish a general figure.
Does this work satisfy our legal obligations?: That isn't ours to decide, and we don't give legal advice. We set up and document technical controls and map them to the requirements you name. Your legal or privacy team confirms whether they meet your obligations.
Do we have to use you for implementation?: No. The review is a complete piece of work. Implementation is a separate, optional scope.

Tell us where your data lives today and what you've been asked to show.

Book a consult