Skip to content
Held in Canada

Vendor questionnaire

Questions to ask a vendor about Canadian data

Fifteen questions for before you sign: where the data is stored, where it is processed, who can reach it, and who owns the company holding it. They are the questions every listing on this site answers from the vendor's own pages.

Ask for a link, not a yes. A good answer points to a page you can keep: the trust centre, the privacy policy, the subprocessor list, the data processing agreement. An answer in an email or a sales call is a start, not a source.

Prints with space for each answer and the page it came from.

The vendor may already be listed: look it up first, and ask about what its listing says is not stated.

Storage

  1. 1

    Where is our data stored at rest: which country, and which region or data centre? Is Canada the default, an option we have to choose, or not offered on our plan?

    “Canadian servers” almost always answers this question and no other. Where Canada is an option, it often has to be switched on, and may depend on the plan.

    A good answer links: the vendor's data residency or region documentation.

  2. 2

    Which of our data does the Canadian storage commitment not cover? Think of logs, account and billing details, search indexes, attachments, notifications and AI features.

    Commitments usually name some services and not others. Microsoft keeps a Canadian tenant's Exchange Online mailboxes in Canada, while Microsoft Forms has no residency commitment and defaults to the US.

    A good answer links: the list of services the residency commitment covers.

  3. 3

    Where are backups and disaster-recovery copies kept?

    A backup is a full copy. QuickBooks Online hosts Canadian customers' books in the US and keeps only a backup in Canada.

    A good answer links: the security page or the data processing agreement.

Processing and access

  1. 4

    Where is our data processed while the service works on it: application servers, AI models, search, transcription, email delivery?

    Stored in Canada and processed elsewhere is common. OpenAI can store API data at rest in Canada, but offers in-region processing only in the US and Europe (and the UAE for some endpoints). PIPEDA, Québec and British Columbia all turn on where data is processed, not only where it sits.

    A good answer links: the region documentation, or the AI feature's own data page.

  2. 5

    Is our data, or anything derived from it, used to train or improve AI models, yours or another company's? Can we opt out in the contract?

    One First Nation's 2026 vendor review asked every vendor to commit that its data is never used to train AI models (OCAP). Nexus AI's privacy policy reserves de-identified transcripts for “other business purposes.”

    A good answer links: the privacy policy, the AI terms or the data processing agreement.

  3. 6

    From where can your staff and contractors reach our data: support, engineering, on-call? Is that access logged, and can we approve it?

    Some rules cover access, not only storage. Nova Scotia public bodies and their service providers must keep personal information “stored only in Canada and accessed only in Canada,” with narrow exceptions.

    A good answer links: the support access policy or the data processing agreement.

  4. 7

    Who are your subprocessors, where is each one, and who owns each? How will you tell us before that list changes?

    Every subprocessor is the same three questions again: storage, processing, ownership. A Canadian vendor can still send data to a US subprocessor.

    A good answer links: the published subprocessor list.

Ownership and control

  1. 8

    Which company do we contract with, who owns it, and who owns that owner, up to the top? Where is each one incorporated?

    The US CLOUD Act reaches data a provider under US jurisdiction controls, wherever it is stored. Hushmail keeps mail in Vancouver and Calgary under a Delaware parent; Notarius's chain may run through a 2025 US private-equity deal.

    A good answer links: the privacy policy's “who we are”, the legal terms, or an investor page.

  2. 9

    Who runs the servers underneath: your own hardware, a Canadian-owned host, or a US cloud (AWS, Microsoft, Google)?

    A Canadian company on a US cloud still has a US company in the chain. It is the difference between tier 1 and tier 2.

    A good answer links: the subprocessor list or the security page.

  3. 10

    Can we hold the encryption keys, so that you could only ever hand over ciphertext?

    Keys you hold are the one control that works wherever the data sits. The federal government's own white paper commits it to keeping exclusive control of the keys for Protected data.

    A good answer links: the encryption or key management documentation.

  4. 11

    If a government demands our data, will you tell us (unless the law forbids it), push back on overbroad demands, and publish how often it happens?

    US Department of Justice policy is to seek a business's data from the business itself first, where practical (CLOUD Act). A vendor that commits to telling you keeps you in the loop.

    A good answer links: a law enforcement request policy or transparency report.

Agreements, assessments and leaving

  1. 12

    Will you sign our agreement with the data's location written in: a data processing agreement, or the information manager or service provider agreement our health privacy law asks for?

    Several provincial health acts set the terms through that agreement (for example Saskatchewan and Manitoba). A residency promise on a web page is not a contract term.

    A good answer links: the standard data processing agreement.

  2. 13

    Which certifications or assessments cover the exact service we would use: SOC 2 Type II, ISO 27001, a Canadian Centre for Cyber Security assessment? What is in scope?

    A logo can cover another product or region. The Cyber Centre's assessments do not consider data residency at all (federal rule).

    A good answer links: the trust centre, with the report's scope.

  3. 14

    Can we export all our data at any time in a usable format, and will you delete it, backups included, when we ask, and confirm it?

    Data held by any outside vendor is not in your possession, the P in OCAP. Export and deletion are what you keep.

    A good answer links: the terms of service or the data processing agreement.

  4. 15

    Will you tell us before any of these answers change: a new region, a new subprocessor, or a sale of the company?

    Owners change. AutoScribe's maker changed hands twice between December 2024 and November 2025.

    A good answer links: the change-notice clause in the agreement.

Which rules apply to you

The questions above matter differently under each. Summaries only, each linking the law or the regulator; not legal advice.

  • US CLOUD Act: Any provider subject to US jurisdiction: US companies, and foreign companies with enough US contacts.
  • Federal residency rule for Protected B data: Federal departments and agencies, and the vendors that serve them.
  • PIPEDA and Bill C-36: Private-sector organizations under federal privacy law.
  • Nova Scotia: PIIDPA, and FOIPOP from 2027: Public bodies, municipalities and their service providers.
  • Québec Law 25 and health information: Businesses, public bodies, and health and social services bodies in Québec.
  • British Columbia FIPPA: Public bodies: ministries, health authorities, school districts, municipalities, universities.
  • Alberta: Protection of Privacy Act and Health Information Act: Public bodies (POPA); health custodians such as physicians, clinics and Alberta Health Services (HIA).
  • Ontario PHIPA: Health information custodians in Ontario.
  • Saskatchewan HIPA: Trustees of personal health information in Saskatchewan (the Act's word for health custodians).
  • Manitoba PHIA: Trustees of personal health information in Manitoba (the Act's word for health custodians).
  • New Brunswick PHIPAA: Custodians of personal health information in New Brunswick, including public bodies.
  • Nova Scotia PHIA: Custodians of personal health information in Nova Scotia. Custodians that are public bodies also fall under the province's public-body residency rule.
  • PEI Health Information Act: Custodians of personal health information in Prince Edward Island.
  • Newfoundland and Labrador PHIA: Custodians of personal health information in Newfoundland and Labrador.
  • OCAP® (First Nations): First Nations governments and anyone handling First Nations data.