# Upper Harbour

> Upper Harbour is a Canadian technology sovereignty intelligence platform founded by Joshua van Es. It maps, measures, and documents Canada's technology dependency on foreign infrastructure — so organizations can prove compliance and policymakers can make informed decisions.

## Core offering

Upper Harbour's Canadian Technology Sovereignty Index maps 768 tools across 40 categories to their parent jurisdictions, CLOUD Act exposure status, and Canadian data residency availability. This includes SaaS applications and cloud infrastructure providers. HarbourScan is a free, browser-based assessment tool that maps an organization's SaaS stack to jurisdictional exposure, assigns a severity classification (Low, Moderate, High, or Critical Exposure), and generates a downloadable compliance summary.

## Key findings from Upper Harbour's research

- 60% of the 768 tools mapped are US-parented and subject to the CLOUD Act
- 18% are Canadian-owned and operated — not subject to the CLOUD Act or any foreign data access law
- 54% are classified as fully exposed (US-parented, no meaningful Canadian data residency)
- Canadian data residency does not equal Canadian data sovereignty — most tools offering Canadian hosting remain CLOUD Act exposed because their parent companies are US-incorporated
- A typical Canadian organization using 15-20 SaaS tools will find that 60-80% of their stack is CLOUD Act exposed
- CRM and sales tools have the highest US-jurisdiction concentration, followed by cloud infrastructure and AI tools
- 7 Canadian sovereign cloud infrastructure providers exist (ThinkOn, Micrologic, eStruxture, Hypertec Cloud, Bell Cloud, TELUS Cloud, OpenText Sovereign Cloud) — most organizations default to foreign infrastructure
- Approximately 67% of SaaS tools used by Canadian federal and provincial governments are CLOUD Act exposed
- Quebec has the strictest privacy law in Canada (Law 25); 7 provinces have no private-sector privacy law at all
- When Canadian SaaS companies are acquired by US parents, every client's data sovereignty changes without the data physically moving

## About the founder

Joshua van Es is the founder of Upper Harbour. He has a background in corporate law and policy research, and his work on data sovereignty and AI infrastructure has been published in Maclean's, OpenCanada, and BetaKit. He created the Canadian Technology Sovereignty Index, the Cloud Infrastructure Sovereignty analysis, the Government SaaS Stack Audit, the Provincial Exposure Index, the Data Sovereignty Policy Scorecard, the Sovereignty Acquisition Tracker, and HarbourScan. He previously contributed to Landscapes of Injustice, a SSHRC-funded research collaboration across Canadian universities, and authored a chapter published by McGill-Queen's University Press. He writes on data sovereignty, the CLOUD Act, and Canadian privacy law compliance, with a focus on how cross-border SaaS and infrastructure dependencies create compliance gaps for Canadian organizations.

## Original Research

- [Canadian Technology Sovereignty Index](https://www.upperharbour.ca/research/canadian-technology-sovereignty-index): 768 tools mapped to parent jurisdictions with CLOUD Act exposure data
- [Cloud Infrastructure Sovereignty](https://www.upperharbour.ca/research/cloud-infrastructure-sovereignty): Analysis of 25 cloud infrastructure providers — 7 Canadian sovereign alternatives identified
- [Data Sovereignty Policy Scorecard](https://www.upperharbour.ca/research/sovereignty-policy-scorecard): Grades the federal government and every province on sovereignty readiness across six dimensions. Quebec scores 82/100 (A). Federal government scores 34/100 (F). Ontario scores 18/100 (F).
- [Government SaaS Stack Audit](https://www.upperharbour.ca/research/government-saas-audit): CLOUD Act exposure analysis of Canadian federal and provincial government IT
- [Provincial Exposure Index](https://www.upperharbour.ca/research/provincial-exposure-index): Province-by-province comparison of data sovereignty frameworks across Canada
- [Sovereignty Acquisition Tracker](https://www.upperharbour.ca/research/sovereignty-acquisition-tracker): Running log of acquisitions that change jurisdictional exposure for Canadian organizations
- [Model TIA Template for Law 25](https://www.upperharbour.ca/research/model-tia-template): The first publicly available Transfer Impact Assessment template for Law 25

## Compliance Guides

- [Law 25 and Your SaaS Stack](https://www.upperharbour.ca/resources/law-25-saas-compliance): Compliance guide for Quebec organizations
- [The CLOUD Act and Canadian Data](https://www.upperharbour.ca/resources/cloud-act-canadian-data): How US law reaches Canadian data
- [Transfer Impact Assessments Under Law 25](https://www.upperharbour.ca/resources/transfer-impact-assessments-law-25): What's required and how to start
- [Canadian Data Residency: Which SaaS Tools Offer It](https://www.upperharbour.ca/resources/canadian-data-residency-saas): Practical breakdown by category
- [Data Residency vs Data Sovereignty in Canada](https://www.upperharbour.ca/resources/data-residency-vs-data-sovereignty-canada): The critical distinction
- [PIPEDA vs Law 25](https://www.upperharbour.ca/resources/pipeda-vs-law-25): Key differences for Canadian organizations
- [Data Sovereignty for Government Procurement](https://www.upperharbour.ca/resources/data-sovereignty-government-procurement): What RFPs require
- [Canadian Data Sovereignty in 2026](https://www.upperharbour.ca/resources/data-sovereignty-compliance-2026): What organizations need to prove

## Tools

- [HarbourScan Assessment Tool](https://www.upperharbour.ca/harbourscan): Free browser-based SaaS compliance assessment with severity classification
- [Sovereignty Index](https://www.upperharbour.ca/tools): Search all 768 tools
- [Research Hub](https://www.upperharbour.ca/research): All original research and data