Methodology

How this is built

Held in Canada records, for 136 software products and cloud services, where Canadian customers' data is stored, where it is processed, and who owns the company that holds it. It exists because vendors blur those three, and because the law cares about them separately.

What each listing records

• Storage: where data at rest lives for a Canadian customer, and whether that is the default, an option, or not offered.
• Processing: where the software runs while handling the data, wherever the vendor says it differs from storage.
• Support and backups: where staff access data from and where copies sit, wherever stated.
• Owner: the company, its parent, and the parent's country. A company that was bought is listed under its buyer.
• Servers run by: whether a US-owned company (AWS, Microsoft, Google and others) runs the infrastructure underneath.
• Keys, certifications, sector notes: recorded where the vendor states them. Blank means not checked, not “none.”

How a claim gets in

• Every claim about where data goes or who owns a vendor cites the vendor's own page (trust centre, privacy policy, data processing agreement, region documentation, investor page), or its parent's. A blog post or a sales sheet alone is not a source.
• Each listing carries the date its pages were checked.
• Pages were read directly where possible. Some vendor sites block automated readers or draw their text in the browser; those were read through a search engine's copy of the same vendor page. The link given is always the vendor's own page.
• Unknowns stay unknown. If a vendor's pages do not say, the listing says “not stated” and suggests what to ask. Nothing is filled in from memory or assumption.
• “Canadian” is never used alone. A listing says Canadian-owned, stored in Canada, or processed in Canada, and those are separate claims.

How tiers are assigned

The tier follows mechanically from three recorded facts: storage, ownership, and who runs the servers.

1. Canadian end to end: Canadian-owned, data stored in Canada, and no US company running the infrastructure underneath.
2. Canadian-owned, data in Canada: Canadian-owned and data stored in Canada, but the servers belong to AWS, Microsoft or Google, or the vendor does not say whose servers they are.
3. Not US-owned, data in Canada: Owned outside Canada and the United States, with data stored in Canada.
4. Run it yourself: Software you install on servers you choose. The vendor never holds your data.
5. US-owned, Canadian region: Data can be stored in Canada, and the owner is a US company.
6. Data leaves Canada: No Canadian storage option, whoever the owner is.
7. Not yet confirmed: The ownership chain or the data location could not be confirmed from the vendor's own pages.

Tiers rank exposure. They say nothing about a product's quality, security, features or price.

On the CLOUD Act, and immunity

No listing is called “CLOUD Act immune,” including Canadian-owned ones. The US Department of Justice says US jurisdiction “is not limited to U.S. corporations, U.S. headquartered companies, or companies owned by U.S. persons.” Canadian ownership lowers exposure; it does not end it. Where a vendor claims immunity, the claim is quoted and attributed, not repeated. The ownership chain is recorded and the reader decides. See the CLOUD Act page.

What this is not

• Not legal advice. Rule pages summarise and link the law or the regulator.
• Not a security audit or a certification.
• Not a review of features or price.

Money

Listings, tiers and rankings are never for sale. If the site carries sponsors in future, they will be labelled “Sponsor” and kept outside the tier lists.

Where this site is hosted

This site, its domain and its DNS are all served by Cloudflare, Inc., a US company. By this site's own tiers, that puts a US company in the chain. The site is static pages: it sets no cookies, runs no analytics and asks for no personal data. Like any web host, Cloudflare sees visitors' IP addresses when it serves a page. The plan is to move to Canadian-owned hosting, which for static files is quick. No third-party scripts or web fonts load from anywhere else.

Corrections

Vendors change regions, owners and terms, and a listing can be wrong. To report one, email corrections@heldincanada.ca with the page, what is wrong, and a link to the vendor's own page that shows it. Vendors are welcome to write too, with the same evidence. A correction is checked against the vendor's page, the listing is updated with a new date, and the change is kept in the site's history.

Last research pass: 2026-10-13.