Canadian Hosting and Data Sovereignty

Data residency is where your data lives. Data sovereignty is whose laws apply to it. Most hosting sold as “Canadian” gives you the first but not the second. The biggest benefit of Canadian hosting for Canadians? It’s faster than the alternatives, and it keeps your dollars in Canada.

Residency and Sovereignty are not the same

A server in Toronto or Montréal gives you Canadian data residency. But if an American company owns that server, your data is subject to US law. The US CLOUD Act lets American authorities order a US company to hand over data it controls, wherever that data is stored. Google Cloud, Amazon Web Services and Microsoft Azure all have Canadian data centres. All three are US companies. A maple leaf on the pricing page does not change that.

Sovereignty needs more than location. It takes a Canadian-owned company, running its own equipment in Canadian data centres, that answers to Canadian courts.

Who requires Data Sovereignty?

• Public bodies and the companies that work for them, under provincial privacy laws.
• Health organisations, and anyone holding health information.
• Member organisations, unions, regulators and professional associations whose members ask where their data lives.
• Anyone whose contracts, funders or purchasing rules require Canadian jurisdiction.

The federal privacy law, PIPEDA, does not ban storing personal information outside Canada. It does hold you responsible for it, and it expects you to inform the people whose information you’re storing abroad. Provincial rules can be stricter. Quebec’s Law 25 requires a privacy impact assessment before personal information leaves the province. Alberta has PIPA for private businesses, the Health Information Act, and separate privacy law for public bodies. This is a general summary, not legal advice. Take it to your privacy officer or lawyer as a starting point when assessing needs and requirements.

Every service has to be Canadian

Web/application hosting is only one part of a network. A site on a Canadian-owned server still sends data across the border if US companies run its CDN, DNS, email servers, forms, analytics, various dependencies, or backups. Form submissions, receipts, and password resets are personal information sent in transactional emails.

What you give up

Canadian-owned hosts are relatively small, with fewer server locations around the world, fewer tools, and less ability to scale than the big US-owned platforms. If most of your visitors are in Canada, that is an easy trade. If they are all over the world, a non-Canadian host may be preferable.

If you do not need true data sovereignty, a Canadian region on a major managed WordPress platform gives you residency and fast pages for Canadian visitors.

What you gain

The greatest benefit of Canadian hosting to Canadians is performance. The nearest server will be the fastest one, all other things being equal. On the east and west coasts, there are many data centres to choose from, but few deliver truly Canadian data residency, sovereignty, and ownership. In western Canada, the range of choices is far slimmer.

It’s also no small thing for the Canadian economy to keep dollars circulating in Canada by preferring Canadian businesses. Every Canadian gains when any Canadian puts Canadian businesses first in their purchasing decisions.

Our Canadian hosting partner: FullHost

The Canadian-owned, data-resident, data-sovereign, high-quality, and fast host I recommend is FullHost.

• FullHost is a Canadian company headquartered in Vancouver, British Columbia.
• Servers and support team members are all across Canada.
• Hardware is owned and operated by the FullHost team in data centres in Toronto, Montreal, Calgary, and Vancouver.
• Managed hosting for WordPress across a range of architectures and price tiers.
• Email hosted entirely in Canada for full data residency.
• An accredited registrar for .ca domains, with DNS management and DNSSEC.
• Managed and unmanaged virtual servers, and a container platform for sites that outgrow shared plans.

I set up, migrate, and care for sites on FullHost. I also do the maintenance, security, performance-tuning, and support work that hosts will not do for you.

Disclosure: I recommend FullHost and GridPane as partners, and I may get a referral fee if you sign up through me. I recommend them because of my experiences with them, their objective benchmarks, and their solid reputations.

Common questions

Is a Canadian data centre enough for data sovereignty?

No. A Canadian location gives you residency. If a US company owns the provider, US law can still reach the data. Sovereignty takes a Canadian-owned and operated provider.

Does PIPEDA require Canadian hosting?

No. PIPEDA lets you process personal information outside Canada, as long as you stay accountable and open about it. Stricter rules usually come from provincial laws, contracts, and sector rules.

Can transactional email stay in Canada?

Yes. Form notifications, receipts, and password resets can go through Canadian-owned services. Most WordPress sites use US-based ones by default.