AWS Canadian Data Sovereignty Analysis

Two Canadian regions

AWS operates two Canadian regions: ca-central-1 (Montréal) and ca-west-1 (Calgary). Together, these provide geographic redundancy entirely within Canadian borders — your data can failover between Canadian regions without ever leaving the country. When you deploy resources in ca-central-1, the physical servers, storage, and networking are in Canada. AWS does not move your data out of the region unless you configure cross-region replication or use a global service.

The shared responsibility model and CLOUD Act

For SaaS tools, the vendor can directly read your data — it's their application. For AWS, the data on your servers is typically encrypted and managed by your application. If you use AWS KMS with customer-managed keys, or bring your own encryption, AWS's ability to produce intelligible data in response to a legal order is significantly limited. AWS can only respond to legal requests where it has the technical ability to do so.

This doesn't eliminate the CLOUD Act exposure — AWS can still be compelled to produce whatever it can access (infrastructure metadata, billing data, access logs). But the practical exposure depends heavily on your encryption and key management architecture. An organization using customer-managed encryption on AWS has a materially different risk profile than one using default settings — or than one using a SaaS tool where the vendor holds all the keys.

Customer-managed encryption — FIPS 140-3

AWS KMS keys are protected by FIPS 140-3 Security Level 3 validated hardware security modules. Keys never leave KMS unencrypted. With customer-managed keys (CMK), you control the key lifecycle — creation, rotation, and deletion. You can also import your own key material or use AWS CloudHSM for dedicated, single-tenant hardware security modules. This is the strongest encryption posture available from any major cloud provider.

Services that behave differently

Not all AWS services operate within a single region. Some are global by design: Route 53 (DNS), CloudFront (CDN), IAM (identity management), AWS Organizations, and certain aspects of billing. Data processed by these global services may transit infrastructure outside ca-central-1. Additionally, AWS AI services — SageMaker, Bedrock, Comprehend — may process data on infrastructure not co-located with your primary region. Map which services you use and which are regional vs global.

The SaaS stack that runs on AWS

Many Canadian SaaS companies host on AWS ca-central-1. When a vendor says "data is stored in Canada," they often mean it's on AWS Montréal. This is legitimate Canadian data residency — but the CLOUD Act exposure exists through AWS as the underlying infrastructure provider. This creates a layered jurisdiction question that organizations should document in their TIAs. Tools like Hootsuite, FreshBooks, and Clio all run on public cloud infrastructure.

Quebec Law 25

The TIA for AWS should document: specific region configuration (ca-central-1 and/or ca-west-1), encryption architecture and key management approach, which services are in use and whether any are global, whether AI services process Canadian data, and the shared responsibility model's implications. AWS provides extensive compliance documentation via AWS Artifact. Upper Harbour provides compliance-ready TIA documentation starting at $99.

Alberta POPA & BC FIPPA

Public bodies using AWS must complete PIAs. Document Canadian region deployment and customer-managed encryption as strong mitigations. The dual Canadian regions (Montréal + Calgary) provide in-country DR — a significant advantage over single-region providers. The PIA Research Tool generates these answers automatically.

EU Sovereign Cloud — precedent for Canada?

AWS launched the European Sovereign Cloud on January 15, 2026 — a physically and logically separate infrastructure with a German legal entity, EU-citizen staff, and independent governance. No Canadian equivalent has been announced, but the EU model demonstrates AWS's willingness to create jurisdictionally isolated environments. Canadian organizations should monitor for similar offerings.

Based on Upper Harbour Sovereignty Index data. March 2026.

Key finding: All three major hyperscalers (AWS, Azure, GCP) are US-incorporated and CLOUD Act exposed. Among them, AWS offers the strongest Canadian coverage with two regions (Montréal + Calgary) providing in-country DR. For full sovereignty, TELUS Cloud (Canadian-owned, sovereign data centres) and OVHcloud (French-owned, Beauharnois QC) are not directly CLOUD Act exposed.