Every advisor in Canada has been told, at some point, that client data should stay in Canada. Fewer have been told what that means in practice, and fewer still know how to check whether a vendor's claim holds up. This is the plain version.
Residency is about where the machines are, not who owns them
"Hosted in Canada" is a statement about geography: the servers holding your data sit in a data centre on Canadian soil. It says nothing about the nationality of the company. A US company can host in Canada, and a Canadian company can host in Virginia. What matters for privacy law and for your clients is where the record physically lives and which country's authorities can compel access to it.
PIPEDA does not forbid storing personal information outside Canada. It requires that you remain accountable for it wherever it goes, that you protect it comparably, and that clients are told when their information may be processed abroad. Several provincial regimes, and many carrier and MGA agreements, go further. In practice, keeping the data in Canada is the simplest way to have a short answer to a long question.
The part that usually gets left out
A vendor's database can be in Canada while the rest of the system is not. The common gaps:
- Files. Signed PDFs and uploaded documents are often stored in a separate service from the database, and that service may default to a US region.
- Processing. The code that reads your data runs somewhere. If the application servers are in the US, the record crosses the border every time a page loads, even though it "lives" in Canada.
- Email. Client emails sent by the platform pass through a mail provider. Many of the popular ones are US-only.
- Backups and logs. Copies of the database, and logs that quote its contents, can be replicated to another region for durability without anyone mentioning it.
- Support tooling. Error-tracking and analytics services routinely receive fragments of real records.
A system can be honest about the database and silent about the rest. That is not always deceit; often the vendor has simply never mapped it.
Five questions to ask
- Where is the database, and where are the file uploads? Ask for the region name, not the country. "ca-central-1" or "Montreal" is an answer; "North America" is not.
- Where does the application run? Serverless and edge platforms default to US regions. Ask whether the region is pinned, and how.
- Which service sends client email, and where is it? Then ask where bounces and complaints are recorded.
- Are backups and logs kept in the same region? And for how long.
- Which third parties receive any part of a client record? A short written list is a good sign. "None that we know of" is not.
What to do with the answers
Write them down. Under PIPEDA's accountability principle you are expected to know where client information is and to be able to explain it. A one-page note listing each system, its region and the date you confirmed it is a reasonable record, and it is exactly the kind of thing a reviewer or a nervous client asks for.
Clientaly's answer, for the record: the database and file storage are in Montreal, the application is pinned to Montreal, client and internal email are sent through Amazon's Canada Central region, and the processors involved are described in the privacy policy. Ask the same of anyone else.