Stored in Canada doesn't mean out of US reach

Ask where your team's handbook, policies and project notes live, and you'll probably hear "Canada. We turned on data residency." Good start. Now ask the follow-up: if a US court orders your vendor to hand those files over, can it refuse?

For most of the tools Canadian teams rely on, it can't. Moving your files north of the border doesn't move the company that holds them.

Location and jurisdiction are different questions

Data residency tells you which country the servers sit in. It matters for speed, for some contracts, and for provincial rules in health care and the public sector.

Jurisdiction tells you whose courts can make the provider disclose your data. It follows the company, wherever the servers are. A US company answers to US law in Toronto exactly as it does in Virginia.

The law behind it

In 2018 the US passed the CLOUD Act. It requires American providers to hand over data in their "possession, custody, or control" when served with a valid order, "regardless of whether such communication, record, or other information is located within or outside of the United States" (18 U.S.C. § 2713).

A provider can ask a US court to set an order aside if obeying it would break another country's law, but only if that country has signed a CLOUD Act agreement with the US (18 U.S.C. § 2703(h)). The UK and Australia have. Canada began talks in 2022 and hasn't signed one.

Microsoft has said as much under oath. In June 2025, a French Senate inquiry asked Microsoft France's director of public and legal affairs whether he could guarantee that French citizens' data would never reach US authorities without France's approval. His answer was "No, I cannot guarantee that." He added that it had never happened. Canadian customers are in the same position.

Where five popular tools stand

1. ¹ Atlassian's "Canada (Central)" region, Standard plan and up. Account details, analytics and logs stay outside it.
2. ² Email, SharePoint, OneDrive and Teams, for organizations that sign up in Canada. Sign-in and identity data sits in a North America region. Wider coverage is a paid add-on.

Sources, read 6 November 2026: Atlassian, Microsoft 365 and Microsoft Entra ID, Google Workspace, Notion, Dropbox. Atlassian moved its parent company to the US in 2022.

Two of the five will keep your documents in Canada. All five answer to US law.

Six questions to put to any vendor

Including us. A vendor that takes your data seriously can answer each one in a sentence.

1. Which country holds my data, including backups, search indexes and logs?
2. What falls outside your residency promise: accounts, analytics, support tickets, logs?
3. Where is your company incorporated, and is any parent or owner a US entity?
4. Who runs the data centre and the network? You, or a US cloud underneath?
5. Which sub-processors touch my data, and where are they?
6. Have you received foreign demands for customer data, and do you publish them?

Our answers

1. Canada. Every file, search index, backup and log.
2. Nothing. Your account, your activity and our logs stay in Canada too.
3. ZedDocs is a Canadian business with no US parent.
4. A Canadian-owned host, on its own hardware and network in Canadian data centres. No capacity rented from a US cloud.
5. No US analytics, fonts, scripts or AI services, on this site or in the product. One exception today: email you send to our addresses passes through a forwarding service on Amazon's cloud in Europe before it reaches our mailbox at Proton in Switzerland. We plan to bring it home.
6. None so far. We will publish every demand we are legally allowed to disclose.

When residency is enough

If your obligation is about where data sits, a US vendor's Canadian region may be all you need, and Confluence and Microsoft 365 both offer one. If it's about who can compel access, you need a provider outside US reach.

This page is a planning guide, not legal advice. For PIPEDA, provincial health privacy law or public-sector rules, check with your privacy officer or counsel.

Last checked 6 November 2026. Spotted something out of date? Tell us at hello@zeddocs.ca.