Canada is securing the bottom of the technology stack. The top — where organizations encounter foreign jurisdiction daily — remains unaddressed.
Hardware at the base. Infrastructure above it. Platforms. And at the top, the SaaS applications employees use every day. Each layer has its own ownership, jurisdiction, and legal exposure.
Each layer is owned by different companies, incorporated in different countries, and subject to different legal regimes. Securing one layer does not secure the layers above it.
Canada is investing billions in sovereign cloud and AI compute. The March 2026 procurement update now requires that providers — and their ultimate parent corporations — are not subject to foreign compelled-disclosure laws. Infrastructure is being addressed. The layers above it are not.
82% of the SaaS tools Canadian organizations use are under foreign jurisdiction. More than a third of major categories have zero Canadian-owned vendors.
90% of application-layer tools advertising Canadian data residency are still under US parent jurisdiction.
715 SaaS and infrastructure tools traced to parent companies, jurisdictions, and compelled-disclosure exposure. The first structured map of Canada’s technology dependency.
Map Your Stack →Sovereign infrastructure does not automatically produce sovereign systems.
Canada’s sovereign cloud strategy is addressing the bottom of the stack. 82% of the SaaS tools organizations use daily remain under foreign jurisdiction. The server is in Canada. The legal authority often isn’t.
Based on the Canadian Technology Sovereignty Index — 690 application-layer tools mapped to parent jurisdictions.
715 SaaS and infrastructure tools traced to parent companies, jurisdictions of incorporation, and compelled-disclosure exposure. The first structured map of Canada’s technology dependency — from cloud providers to the applications running on top of them.
Four federal instruments address digital sovereignty. None apply a parent-jurisdiction test to SaaS vendors.
Requires ultimate parent corporations not subject to foreign compelled-disclosure laws.
Defines sovereignty. Explicitly “distinct from procurement policies.”
Preferences Canadian suppliers. No field for parent jurisdiction.
$2B for AI infrastructure. Bell-Hypertec, Cohere, university partnerships.
HarbourScan maps your SaaS tools to parent jurisdictions, CLOUD Act exposure, and compliance gaps. Free. Two minutes.
Map Your Stack →