Tiers
Two questions, one ranking
Every listing answers two separate questions. Where is the data stored? That is what most residency rules ask. Who owns the company holding it? That decides whether a foreign government can make the company hand it over.
The tiers combine the two. They rank exposure, not quality, features or price.
- Tier 1: Canadian end to end12 listings
Canadian end to end
Canadian-owned, data stored in Canada, and no US company running the infrastructure underneath.
No US company appears in the hosting chain as far as the vendor's own pages show. This is the strongest answer available to the ownership question, and it is still not immunity: US jurisdiction is not limited to US companies.
- Tier 2: Canadian-owned, data in Canada14 listings
Canadian-owned, data in Canada
Canadian-owned and data stored in Canada, but the servers belong to AWS, Microsoft or Google, or the vendor does not say whose servers they are.
The company you contract with is Canadian, and the data sits in Canada. A US company still runs the machines in many of these, which a strict review will ask about.
- Tier 3: Not US-owned, data in Canada16 listings
Not US-owned, data in Canada
Owned outside Canada and the United States, with data stored in Canada.
Data stays in Canada and the owner is not American. Some of these still run on a US cloud, which each listing records.
- Self-hosted: Run it yourself7 listings
Run it yourself
Software you install on servers you choose. The vendor never holds your data.
Where the data lives and who can reach it depends on where you run it. On Canadian-owned or your own hardware, this is the only route to full possession (the P in OCAP). You also carry the operations: patching, backups, on-call.
- Tier 4: US-owned, Canadian region38 listings
US-owned, Canadian region
Data can be stored in Canada, and the owner is a US company.
Passes most storage-location rules. Does not pass an ownership test: the US CLOUD Act requires a US provider to produce data in its possession, custody or control wherever it is stored.
- Tier 5: Data leaves Canada34 listings
Data leaves Canada
No Canadian storage option, whoever the owner is.
Fails rules that require storage in Canada (Nova Scotia public bodies, federal Protected B by default) and needs a privacy impact assessment where the law requires one before data leaves Canada or Québec.
- Unconfirmed: Not yet confirmed15 listings
Not yet confirmed
The ownership chain or the data location could not be confirmed from the vendor's own pages.
Unknowns stay unknown here. Each of these listings says what to ask the vendor before relying on it.