67% of SaaS tools used by Canadian organizations are US-owned and CLOUD Act exposed. Enter your tools. See which fall under foreign jurisdiction, where your compliance gaps are, and what to do about it. What is the CLOUD Act? →
Check Your Stack →Free · Browser-based · No signup required
Built on the 767-tool Canadian Technology Sovereignty Index
When a regulator, procurement officer, or partner asks “which of your SaaS vendors are subject to foreign jurisdiction?” — most organizations cannot answer. HarbourScan produces that answer in minutes. (Why jurisdiction matters more than data residency →)
Start with a free scan. Add compliance reports or consulting when you need them.
“I need to see what we’re dealing with.” — Enter the tools your organization uses. See which ones fall under foreign jurisdiction, where your compliance gaps are, and what Canadian alternatives exist. Runs entirely in your browser.
“We need to prove we’ve done the work.” — Canadian organizations are required under Quebec’s Law 25 to complete Transfer Impact Assessments. BC’s FIPPA requires Privacy Impact Assessments. Penalties under Law 25 reach $25 million or 4% of worldwide turnover. Our reports are pre-built with jurisdictional data for each tool.
“We need someone to scope this properly.” — For organizations that need a full sovereignty assessment, remediation roadmap, vendor migration strategy, or board-ready compliance documentation. We’ll scope it based on your scan results and your regulatory obligations.
No. The scan runs entirely in your browser. Nothing is sent to our servers or stored anywhere. You can optionally email yourself a summary of your results, but the scan itself is completely private.
Most organizations complete the scan in under 10 minutes. You select your tools from a database of 767 mapped SaaS products, and HarbourScan instantly maps each one to its parent jurisdiction and CLOUD Act status.
Just a list of the SaaS tools your organization uses. No login, no account, no access to your systems. You select tools from our database and HarbourScan does the rest.
Transfer Impact Assessment and Privacy Impact Assessment reports, pre-built with jurisdictional data from our 767-tool database. Available from $99 with immediate PDF delivery. Required under Quebec's Law 25 and BC's FIPPA.
The $99 compliance reports cover standard TIA and PIA documentation. If you need a full sovereignty assessment, remediation roadmap, vendor migration strategy, or board-ready documentation, consulting gives you expert guidance scoped to your specific situation.
Most organizations complete the scan in under 10 minutes. No account required. Choose the level of documentation you need after you see your results.
Want to discuss your situation first? Book a call · Compliance reports
Most organizations start here when a regulator, partner, or procurement review asks how their SaaS vendors handle data. The initial scan runs entirely in your browser.
Search for the SaaS tools your organization uses. We'll map each one to its parent jurisdiction. Add as many as apply.
Based on the 0 tools you selected, here's your organization's jurisdictional exposure.
Most organizations discover at least one foreign-controlled SaaS tool processing personal data without documented safeguards. If your organization were asked to produce a defensible processing inventory today — could you?
We'll send a summary of your scan — jurisdiction breakdown, CLOUD Act exposure, and compliance gaps — within one business day.
No spam. Just your scan results and a note from the founder.
Your scan results are ready to be documented.
Canadian organizations are required under Quebec’s Law 25 to complete Transfer Impact Assessments for any personal data processed by foreign-jurisdiction vendors. Penalties reach $25 million or 4% of worldwide turnover.