Independent research on Canadian data sovereignty

In June 2025, Microsoft France's director of public and legal affairs testified before the French Senate that if a legally valid US order is issued under the CLOUD Act, Microsoft must comply — regardless of where data is stored. Microsoft subsequently pledged $7.5B to build Canadian AI infrastructure with promises to "defend digital sovereignty." But contractual promises cannot override statutory obligations. Our research quantifies the gap between vendor sovereignty claims and jurisdictional reality: most of the SaaS and cloud infrastructure tools Canadian organizations rely on are operated by companies that cannot guarantee sovereignty under oath.

Prime Minister Carney announced plans to build a "Canadian sovereign cloud" through the Major Projects Office. Minister Solomon has called digital sovereignty "the most pressing policy and democratic issue of our time." But the policy conversation focuses on infrastructure — servers and data centres. Our research shows the problem sits one layer up: in the SaaS applications running on that infrastructure. A sovereign cloud running US-parented SaaS is not sovereign. The tools in our index represent the application layer that cloud strategy alone doesn't address.

Quebec's Law 25 has required Transfer Impact Assessments for cross-border data transfers since September 2023. In 2023–2024, the CAI received 277 privacy complaints and 444 confidentiality incident notifications. Yet our analysis suggests the typical Quebec organization using 15–20 SaaS tools needs 10–16 TIAs — and most haven't completed a single one. The proposed federal CPPA would extend similar requirements nationally. The compliance infrastructure doesn't exist yet. That's what we're building.

The Council of Canadian Innovators has called for "buy Canadian" rules in government tech procurement. SHIELD has proposed a Sovereignty Score measuring Canadian ownership and control. Our Sovereignty Acquisition Tracker documents how Canadian SaaS companies are quietly acquired by US-incorporated parents — shifting jurisdictional exposure for every Canadian client. Only a small fraction of the tools in our index are Canadian-headquartered. Without tracking corporate ownership changes, sovereignty assessments go stale the moment an acquisition closes.