Key findings
The Canadian Technology Sovereignty Index is Upper Harbour's proprietary research database covering 715 tools across 32 categories commonly used by Canadian organizations. Each tool has been mapped to its parent company, country of incorporation, CLOUD Act exposure status, and Canadian data residency availability.
Of the 715 tools in the index, approximately 448 (63%) are parented in the United States and subject to the CLOUD Act. Among the tools that offer Canadian data residency as an option, 88% are still CLOUD Act exposed because their parent companies are US-incorporated. Only 18% of tools in the index are Canadian-headquartered, offering both data residency and data sovereignty.
Jurisdiction breakdown by category
CLOUD Act exposure varies significantly by SaaS category. Categories dominated by US vendors present the highest jurisdictional risk for Canadian organizations under Law 25:
| SaaS Category | Tools | US-Parented | Canadian-HQ | Other |
|---|
Legal practice management and healthcare are the only categories where Canadian-headquartered alternatives represent a meaningful share of the market. In every other category, US-parented vendors dominate, meaning the majority of a typical Canadian organization's SaaS stack is CLOUD Act exposed.
Sample data: 50 of 715 tools
The following table shows a representative sample of tools from the index. Search the full dataset or run HarbourScan to map your specific stack.
| Tool | Category | Parent HQ | CLOUD Act | CA Residency |
|---|
Source: Upper Harbour Canadian Technology Sovereignty Index. Parent jurisdiction determined through corporate registry filings and SEC disclosures. Browse all 715 tools →
What "buy Canadian" actually looks like
Across the full 715-tool index, we classify each tool into one of four ownership categories:
The numbers tell a clear story: only 18% of the tools Canadian organizations rely on are fully Canadian-owned. Another 11% require review — Canadian-headquartered but foreign-backed, or offering mitigations like Canadian data residency without resolving the underlying jurisdictional question. The remaining 17% are non-US foreign vendors, and the majority are CLOUD Act exposed.
This matters for three reasons.
First, "buy Canadian" without a definition is unenforceable. When the Council of Canadian Innovators calls for Canadian-ownership requirements in government procurement, the question is: which category qualifies? Is 1Password — headquartered in Toronto, backed by US venture capital — Canadian enough? The answer has real procurement consequences, and no government has published a clear standard.
Second, the Canadian-owned category is shrinking. The Sovereignty Acquisition Tracker documents Canadian SaaS companies that have been acquired by foreign parents. This is not a one-time event — it is a pattern. Private equity roll-ups, strategic acquisitions, and Delaware reincorporations move companies out of the Canadian-owned category regularly. Without ongoing monitoring, any sovereignty assessment goes stale the moment an acquisition closes.
Third, sovereignty and ownership are the same question. This is the point the Canadian SHIELD Institute has made in its Sovereignty Score framework: sovereignty isn't just about where data is stored — it's about who controls the infrastructure. A "buy Canadian" policy that accepts Canadian-headquartered, foreign-parented companies as sovereign is a policy that accepts CLOUD Act exposure as an acceptable tradeoff. Whether that's the right call is a political decision. But it should be a conscious one, not a default.
We classify tools based on corporate registry filings, SEC/SEDAR disclosures, and publicly reported funding rounds. "Canadian-owned" requires Canadian incorporation of the ultimate parent, majority Canadian ownership or public listing on a Canadian exchange, and no foreign parent company. "Canadian-HQ, foreign-backed" indicates Canadian headquarters with significant (>30%) foreign institutional investment. "Formerly Canadian" tracks companies that were Canadian-owned at founding and have since been acquired by foreign parents. Classifications are reviewed quarterly as part of the index update cycle.
What this means for Canadian organizations
A typical Canadian organization using 15–20 SaaS tools will find that 60–80% of their stack is CLOUD Act exposed. For Quebec organizations subject to Law 25, this means 10–16 Transfer Impact Assessments are likely required — each documenting the jurisdictional exposure, the legal framework of the receiving jurisdiction, and the contractual safeguards in place.
Most Canadian organizations have not completed a single TIA. This requirement has been in effect since September 22, 2023. Organizations that are using cross-border SaaS tools without documented assessments have been technically non-compliant for over two years.
The Canadian Technology Sovereignty Index was compiled by Joshua van Es at Upper Harbour through primary research into corporate ownership structures, SEC filings, provincial and federal corporate registries, and vendor documentation. Each tool was evaluated for parent company jurisdiction, CLOUD Act applicability, Canadian data residency availability, and DPA availability. The index is updated quarterly. Last update: March 2026.
Compliance implications
Under Law 25 (Quebec): Every US-parented SaaS tool processing personal information of Quebec residents triggers a mandatory Transfer Impact Assessment. The assessment must evaluate the US legal framework — including the CLOUD Act — and document whether adequate protections exist. Canadian data residency does not eliminate this requirement.
Under PIPEDA (Federal): While PIPEDA doesn't mandate formal TIAs, the Office of the Privacy Commissioner recommends organizations assess the legal framework of foreign jurisdictions. The proposed Consumer Privacy Protection Act (CPPA) would make this assessment mandatory at the federal level.
For government procurement: Federal and provincial government RFPs increasingly include data sovereignty requirements. The Government of Canada's Digital Sovereignty Framework identifies foreign technology dependencies as a strategic risk. Vendors selling into government need documented sovereignty positioning across their SaaS stack.
How to use this data
Search the Sovereignty Index to look up any tool's parent jurisdiction, CLOUD Act status, and Canadian data residency — instant and free.
HarbourScan, Upper Harbour's free assessment tool, draws on this database to map an organization's specific SaaS environment to jurisdictional exposure. It identifies which tools are CLOUD Act exposed, flags missing TIAs and DPAs, and generates a compliance gap report. The assessment runs entirely in the browser and takes approximately 10 minutes.
For a deeper dive into the compliance requirements these findings connect to, see Upper Harbour's guides on Law 25 and your SaaS stack, the CLOUD Act and Canadian data, Transfer Impact Assessments, data residency vs data sovereignty, and PIPEDA vs Law 25.