Residency is not sovereignty
Where your data is, and who controls the service: two different questions.
Two questions
Data residency answers "which country are the servers in". Sovereignty answers "which law does whoever controls the service obey". A data centre in Montreal can be run by a US company: the data resides in Canada, but the provider remains subject to US law.
The CLOUD Act
Passed in the United States in 2018, this law lets US authorities require a service provider to disclose data in its possession, custody or control, whether that data is in the United States or abroad. Where the data is stored is therefore not enough to put it out of reach.
What you can check
- Which country are the servers in, including the backup servers?
- Which company runs the service, and which country does its parent company answer to?
- Does the contract say what happens if a foreign authority asks for your data?
What TSI does
Your data is in Beauharnois, Quebec, at OVHcloud, a French group, and the service is run by TSI, a Canadian corporation based in Repentigny. The software is free software: you can leave with your data and run it elsewhere.
Keep in mind
This article explains a distinction. It is not legal advice: for a decision that commits your organization, consult a legal professional.
See where you stand on Law 25
Ten questions, three minutes.
Take the self-check