Parent Company
monday.com Ltd. (Israel)
CLOUD Act Status
⚠ Indirect Exposure
Canadian Data Residency
✗ Not Available
Encryption
⚠ BYOK (Guardian add-on)
TIA / PIA Required
Yes — Law 25 & POPA
Incorporation
Israeli Companies Law, 2012

Is Monday.com CLOUD Act exposed for Canadian organizations?

Not directly — and this matters. monday.com Ltd. was incorporated in Israel in 2012 (originally as DaPulse Labs Ltd.) under the Israeli Companies Law. It is headquartered in Tel Aviv-Yafo. Unlike Jira (Atlassian, Delaware) and Asana (Delaware), Monday.com is not a US company. It files with the SEC as a foreign private issuer — a fundamentally different legal classification that affects how the CLOUD Act applies.

The CLOUD Act compels US-based technology companies to produce data. Monday.com is not US-based. A US court cannot directly compel monday.com Ltd. to produce data under the Stored Communications Act the way it can compel Microsoft, Atlassian, or Asana.

However, the picture is more complex than "Israeli = safe." Monday.com has significant US presence: it's listed on NASDAQ (MNDY), has US sales offices and employees, and hosts data primarily on AWS infrastructure in the United States. US courts can exercise jurisdiction over foreign companies with sufficient "minimum contacts" in the US — and Monday.com clearly has substantial US contacts. Whether this is enough for a US court to enforce a CLOUD Act order against Monday.com is an evolving legal question without definitive case law.

Additionally, while Monday.com itself may resist a US legal order, the data sits on AWS — a US company that is directly subject to the CLOUD Act. This creates a second pathway for US government access: a court order directed at Amazon Web Services for data stored on its US infrastructure. AWS has stated it has never disclosed enterprise customer data stored outside the US to the US government — but the legal authority exists.

The bottom line: Monday.com has the strongest jurisdictional positioning of any major project management platform for Canadian organizations. Israeli incorporation provides a structural barrier that US-incorporated competitors simply don't have. But US data hosting and significant US business presence create indirect exposure that prevents a clean sovereignty bill of health.

Regulatory Analysis

▾

CLOUD Act — the nuanced case

The CLOUD Act applies to providers of electronic communication or remote computing services "subject to US jurisdiction." Monday.com is not a US company, but the question of whether it is "subject to US jurisdiction" for CLOUD Act purposes turns on the "minimum contacts" analysis under US constitutional law.

Monday.com's US contacts include: NASDAQ listing (MNDY), US sales and marketing offices, significant US customer base, and US-hosted data infrastructure (AWS Northern Virginia). US courts have held that even a single act creating a "substantial connection" with the US can support jurisdiction. Monday.com's contacts are far more extensive than any single act.

This doesn't mean the CLOUD Act definitively applies to Monday.com. It means the legal position is uncertain — which for compliance documentation purposes is importantly different from both "exposed" (like Atlassian) and "not exposed" (like a Canadian-owned tool with Canadian hosting). Your TIA or PIA should document this uncertainty honestly.

🍁
Your Canadian Data
Tasks, projects, boards
under PIPEDA / Law 25
🏢
monday.com Ltd.
Tel Aviv, Israel (since 2012)
Not a US company
☁️
AWS (US Infrastructure)
Northern Virginia
AWS is CLOUD Act exposed

The "two pathways" problem

Even if Monday.com itself is not directly reachable under the CLOUD Act, there's a second pathway: a US court order directed at AWS. Amazon Web Services is a US company that controls the physical infrastructure where Monday.com's data sits. While AWS has published strong transparency commitments, the legal authority for the US government to compel AWS to produce data hosted on its infrastructure exists under the CLOUD Act. This is a theoretical pathway — AWS states it has never disclosed enterprise customer data stored outside the US — but it represents a structural risk that doesn't exist with Canadian-hosted infrastructure.

Israeli privacy law

Israel has been recognized by the European Commission as providing "adequate" data protection — one of only 17 countries with this designation. Israel's Protection of Privacy Law (1981) and Privacy Protection Regulations provide a framework that, while different from Canadian law, offers meaningful privacy protections. For TIA purposes, this is a relevant factor: the vendor's home jurisdiction has strong privacy norms, even if the data is hosted on US infrastructure.

Quebec Law 25

Quebec organizations using Monday.com must complete a Transfer Impact Assessment. The TIA must document: data is hosted in the US (or EU if configured), Monday.com is Israeli-incorporated (not directly CLOUD Act exposed), but data sits on US infrastructure operated by a CLOUD Act-subject company (AWS). The Israeli incorporation should be documented as a meaningful jurisdictional mitigation. Upper Harbour provides compliance-ready TIA documentation starting at $99.

Alberta POPA

Alberta public bodies deploying Monday.com must complete a PIA using the mandatory OIPC template. Section G should document Monday.com's Israeli incorporation and the indirect nature of the CLOUD Act exposure — this is genuinely different from documenting a US-incorporated tool. Section H2, Risk 7 should note that the parent company is not directly subject to the CLOUD Act, while the hosting infrastructure is. The PIA Research Tool generates these answers automatically from our 753-tool database.

BC FIPPA

BC public bodies should note that Monday.com's Israeli incorporation provides better jurisdictional positioning than US-incorporated alternatives. However, data is still hosted on US infrastructure with no Canadian data residency option. Full FIPPA SaaS compliance guide →

No Canadian data residency — a significant gap

Despite Monday.com's strong jurisdictional positioning, it offers no Canadian data residency. Data can be hosted in the US (default), EU (Germany, available on Enterprise and for Standard/Pro accounts created after January 2023), or Australia (APAC). Canadian organizations cannot pin their data to Canadian servers. And account-level data — user credentials, profiles, usage analytics, and metadata — is always stored in the US regardless of which data region is selected.

Monday.com is one of 753 tools in the Upper Harbour Sovereignty Index. It has the best jurisdictional positioning of any major PM tool — but your stack doesn't stop at project management. If you use Monday.com alongside Microsoft 365, Slack, Zoom, or Salesforce, those tools are all US-incorporated and fully CLOUD Act exposed. Sovereignty compliance requires assessing every tool, not just the one with the best story.

Map your entire SaaS stack to parent jurisdictions and CLOUD Act exposure in 10 minutes.
Map Your Stack →

Alternatives & Comparison

▾

Monday.com occupies a unique position: the best jurisdictional status of any major PM tool, but without Canadian data residency. Here's how it compares:

ToolOwnershipCLOUD ActCDN ResidencyCustomer Keys
Monday.comIsraelIndirectNoBYOK (Guardian)
JiraUS (Delaware)ExposedAvailableCMK add-on
AsanaUS (Delaware)ExposedNoEKM (Ent+ only)
ClickUpUSExposedNoNo
WrikeUS (Citrix)ExposedEU availableNo

Based on Upper Harbour Sovereignty Index data. March 2026.

The sovereignty paradox: Monday.com has the best corporate jurisdiction (Israeli, not directly CLOUD Act exposed) but lacks Canadian data residency. Jira has the worst corporate jurisdiction (US-incorporated) but offers Canadian data residency. Neither gives you both. The "best" choice depends on whether your compliance framework prioritizes corporate jurisdiction or data location — document your reasoning.

💬 Questions about Monday.com and Canadian compliance?

We help organizations assess jurisdictional risk across their SaaS stack. Book a call or send us a message.

Book a Call → Email Us →

Technical Architecture

▾

Data storage and regions

Monday.com hosts data on AWS across three regions: US (Northern Virginia, default), EU (Frankfurt, Germany), and APAC (Sydney, Australia — launched 2023). No Canadian data residency is available. Your account's data region is set automatically based on the location of the first user who opens the account — and once set, it cannot be easily changed. A new account must be created in the desired region.

EU data residency is available on Enterprise plans, and on Standard and Pro plans created on or after January 23, 2023. For APAC accounts, some data processed by sub-processors may still be hosted outside the APAC region.

Critical limitation: Account-level data — including user credentials, profiles, usage analytics, and metadata from automations and integrations — is always stored in the US regardless of which data region is selected. Only "customer data" (boards, items, updates, files) follows the data region setting. This means even with EU data residency enabled, some data about your users remains on US infrastructure.

Encryption

Monday.com encrypts data at rest (AES-256) and in transit (TLS 1.3, minimum TLS 1.2). Encryption keys are stored in AWS KMS with annually rotated customer master keys. Two encryption tiers:

  • Default (monday.com-managed keys): Standard on all plans. Monday.com manages encryption keys in AWS KMS. Under a legal order, Monday.com (or AWS) could produce data in readable form.
  • BYOK (Bring Your Own Key): Available with the Enterprise Guardian add-on. Allows organizations to store encryption keys in their own AWS KMS or Azure Key Vault. Provides revocation capability and audit independence through CloudTrail/Azure logs. Does not prevent legal compulsion but gives the customer a kill switch.

Infrastructure architecture

Monday.com uses a multi-tenant architecture with logical separation between customers. Databases include MySQL, Elasticsearch, and Redis. API keys for external integrations are stored in a dedicated HashiCorp Vault cluster. All engineering access to production servers requires VPN authenticated against the enterprise identity provider with MFA enforced. The infrastructure runs across multiple AWS Availability Zones with disaster recovery in a separate region.

AI features

Monday.com has stated that it does not use customer data to train its AI models. AI features follow the same security protocols as the core platform. For organizations concerned about AI data processing, Monday.com's AI Trust Center provides details on how AI features interact with customer data.

Marketplace apps

Monday.com's app marketplace allows third-party integrations. Apps can support multi-region deployment through Monday.com's developer framework. However, not all apps support data residency — each app must be individually assessed. Monday.com requires app developers to have documented mechanisms for security breach notification.

Mitigation Options

▾

Monday.com's Israeli incorporation is itself the primary sovereignty mitigation — a structural advantage that no US-incorporated competitor offers. Additional steps to strengthen your position:

  • Enable EU data residency (if no Canadian option): EU hosting removes customer data from US soil, although account data remains in the US. EU hosting through an Israeli company on European infrastructure represents the strongest available data residency configuration — your data is physically in the EU, controlled by an Israeli company, with no US corporate parent in the chain.
  • Enable BYOK encryption (Enterprise Guardian): If available on your plan, BYOK via AWS KMS or Azure Key Vault gives you control over encryption keys and the ability to revoke access. Choose a key region that aligns with your data residency preferences.
  • Document the jurisdictional advantage: Your TIA or PIA should explicitly note that Monday.com is not a US company, not directly subject to the CLOUD Act, and that this represents a meaningfully different jurisdictional profile than US-incorporated alternatives. This distinction matters to regulators and procurement officers.
  • Acknowledge the residual risk: Document that data is hosted on AWS US infrastructure (unless EU residency is configured), that account-level data remains in the US regardless, and that the CLOUD Act could potentially reach Monday.com through indirect jurisdiction. Be honest about the uncertainty — it's more credible than claiming zero risk.
  • Monitor for Canadian data residency: Monday.com has been expanding regions (EU in 2021, APAC in 2023, UAE discussed). Canadian data residency may be added in the future. When it is, the combination of Israeli incorporation + Canadian data hosting + BYOK would create the strongest sovereignty posture of any major PM tool.

Bottom line: Monday.com is the best-positioned major project management tool for Canadian sovereignty — not because it's perfect, but because Israeli incorporation removes the most direct CLOUD Act pathway. If you must use a major PM platform, Monday.com + EU data residency + BYOK is a defensible choice. Document your reasoning and the residual risks.

Frequently Asked Questions

▾

Is Monday.com subject to the US CLOUD Act?

Not directly. monday.com Ltd. is incorporated in Israel and files with the SEC as a foreign private issuer. The CLOUD Act applies to US-based technology companies — Monday.com is not US-based. However, its NASDAQ listing, US offices, and US-hosted data create "minimum contacts" that could theoretically support US jurisdiction. The legal position is uncertain, which is meaningfully different from the clear exposure of US-incorporated competitors.

Does Monday.com offer Canadian data residency?

No. Monday.com offers data hosting in the US (default), EU (Germany), and Australia (Sydney). Canadian data residency is not available. Account-level data (user credentials, profiles, analytics) is always stored in the US regardless of which region is selected.

Can the US government access Monday.com data through AWS?

Theoretically, yes. AWS is a US company subject to the CLOUD Act. While AWS has stated it has never disclosed enterprise customer data stored outside the US to the US government, the legal authority exists. This "two pathways" risk — through Monday.com directly (uncertain) or through AWS (technically possible) — is unique to the Israeli-company-on-US-infrastructure configuration.

Do I need a TIA for Monday.com under Law 25?

Yes. Data leaves Quebec and is stored in the US (or EU if configured). A TIA is required regardless of Monday.com's Israeli incorporation. The TIA should document the Israeli incorporation as a meaningful jurisdictional advantage while noting the US hosting risk.

How does Monday.com compare to Jira for sovereignty?

It depends on what you prioritize. Monday.com has better corporate jurisdiction (Israeli, not directly CLOUD Act exposed) but no Canadian data residency. Jira has worse corporate jurisdiction (US-incorporated, fully CLOUD Act exposed) but offers Canadian data residency and customer-managed encryption. Neither gives you both advantages.

Does Monday.com offer customer-managed encryption?

Yes — through BYOK (Bring Your Own Key) on the Enterprise Guardian add-on. Keys can be stored in AWS KMS or Azure Key Vault. This provides key lifecycle control and revocation capability. It does not prevent legal compulsion but provides operational control and audit visibility.

Methodology: This assessment is based on monday.com's corporate filings (SEC), vendor documentation, published DPA terms, and the Upper Harbour classification methodology. Data verified March 2026. Updated quarterly. Part of the Canadian Technology Sovereignty Index.