The situation
Athena Collective is a platform for women founders, offering personalized business assessments, a searchable member directory, and community tools. Hundreds of members across Canada share personal information through the platform — skills assessments across 212 areas, profiles searchable by stage, industry, and location, and direct community interactions.
That's a lot of personal data flowing through a SaaS stack. Co-founder Mikayla Stewart had already made a smart infrastructure choice: hosting on DigitalOcean's Toronto region, keeping core application data in Canada. But with Law 25 in effect since September 2023, she needed to document the full jurisdictional picture — not just where data is stored, but who can be legally compelled to produce it.
The alternative was expensive. Privacy consultants typically charge $15,000–$40,000 for a full Law 25 compliance engagement. Individual TIAs from law firms run $2,000–$5,000 per tool — for 9 cross-border tools, that's $18,000–$45,000 in legal fees alone. Doing it internally means 20–30+ hours of research before any documentation gets written.
What the scan revealed
Athena Collective ran a HarbourScan, mapping all 11 tools against Upper Harbour's 715-tool sovereignty database.
Why DigitalOcean Toronto wasn't enough
Mikayla's choice to host in Toronto keeps core data — databases, file storage, compute — physically in Canada. That's a meaningful starting point.
But DigitalOcean is US-incorporated. Under the CLOUD Act, US law enforcement can compel data production regardless of server location. Canadian residency creates friction, but it doesn't close the legal question. This is exactly the nuance Law 25 documentation captures: here's the residency configuration, here's the jurisdictional reality, and here's the assessed risk.
What was delivered
The takeaway
Law 25 doesn't require you to replace your SaaS tools. It requires you to document them.
Athena Collective kept every tool in its stack. What changed was the paper trail — a structured record showing that jurisdictional exposure has been identified, assessed, and documented. That's what compliance looks like in practice.
The proposed federal Consumer Privacy Protection Act (CPPA) would extend similar documentation requirements nationally. Organizations that document now are building on solid ground.