How to check Canadian data residency claims from email vendors

What to take away

What a residency claim actually promises

Data residency means the vendor stores your data in a named country or region. It says nothing about who can reach it. Vendor staff, contractors and automated systems can sit anywhere and still open the file.

For a Canadian public sector buyer the question narrows to three parts. Where do the bytes sit, who can access them, and under whose law? A vendor can host in Ontario and still route support tickets through a United States queue. That passes a residency claim and fails a procurement review.

Canadian regions exist in Ontario, Quebec and sometimes British Columbia or Alberta. Availability differs by product. A vendor may offer Canada for email but not for meeting recordings, or for files but not for the search index sitting on top of them.

Provincial expectations differ. British Columbia publishes data and information management guidance that shapes how its public bodies treat residency. Quebec's Law 25 adds obligations for personal information that federal guidance does not cover.

The Office of the Privacy Commissioner of Canada sets the federal frame. Its federal government privacy guidance shapes how departments procure and retain email records. Read that before you read a vendor's trust page.

Treat every claim as a statement to test against documentation, configuration and contract language. The three tests below are where most claims break.

Three tests: logs, latency and support answers

Documentation tells you what the vendor says. Testing tells you what the service does. Three tests are cheap and hard to argue with.

Logs first. Admin audit logs usually record the region, server or data centre for each event. Pull a week of logs for email, files and meeting recordings and check the region field.

In the Microsoft Purview unified audit log, read the ClientIP field and geolocate the address. In the Google Workspace Admin console audit log, read the IP address column. A session from your Toronto office that resolves to a United States address is a finding.

Latency second. Measure round-trip time to the service endpoint from two offices, one in Canada and one in the United States. From a Toronto office, a Canadian region typically answers in under 30 milliseconds. A United States East region typically answers in 40 to 70 milliseconds.

A consistent delta of 20 milliseconds or more, request after request, suggests traffic is terminating outside Canada. Routing and peering can produce the same numbers, so confirm the result against the audit logs.

Support answers third. Ask one specific question: "Which region stores meeting recordings and transcripts for our tenant?" A vague answer is a signal. Get the answer in writing and keep it with the contract file.

Reading trust pages and subprocessor lists

The trust page names regions and certifications. Look for the specific Canadian region, not the word Canada in a logo wall. A page saying "Canadian data residency available" without naming the region or the products is marketing, not documentation.

The subprocessor list is the most underrated document in the stack. It names every third party that can touch your data: hosting providers, analytics vendors, support tooling, translation services and backup operators. Each entry should carry a location and a purpose.

Read it for two things. Entries outside Canada that process your content, and entries vague about location. "Global infrastructure" is not a location. If a subprocessor handles support tickets or backups, its location matters as much as the primary region.

Vendors update these lists on a schedule, often with notice periods. Find the notice clause. If the vendor can add a subprocessor with no notice and no objection right, your residency position can change after you sign. That is a contract problem, not a documentation problem.

Contradictions between the trust page and the list are common. The trust page says Canadian hosting; the list shows a United States analytics provider ingesting usage data. Usage data may fall outside your residency scope, or it may not. Decide which, in writing.

Standards for this work move too. The OPC's AI and technology positions shape how regulators view automated processing of records, so read them alongside the trust page rather than after it.

Residency and permissions are separate controls, and auditors ask about both. The permission model a vendor sells you decides who inside your own organization can reach the data once it lands in Canada.

Testing region selectors across three workloads

Region selectors are the fastest way to test a claim. Most enterprise vendors expose a region choice at tenant creation, and some allow migration later. The selector is where the marketing claim meets your configuration.

Work through email, files and meeting recordings separately. They often have different residency behaviour, different admin controls and different subprocessors. One vendor can pass for email and fail for recordings.

Two named vendors show how much a selector leaves open. Microsoft 365 takes the tenant's data location from the country you choose when the tenant is created. The Microsoft 365 admin center shows that value under Settings > Org settings > Organization profile.

That location applies to the workloads Microsoft names in its coverage list. It does not apply to everything the tenant touches. Usage telemetry, billing records and support tooling sit outside it.

Moving a live tenant to another region is a migration project, not a dropdown. Microsoft sells wider commitments, such as Advanced Data Residency and Multi-Geo, as separate add-ons.

Google Workspace keeps its control in the Admin console under Account > Data regions. The setting covers the data types Google lists for each service, and coverage differs by service and by edition. It is not a blanket switch over everything a user can create, so check the coverage list against your own workload inventory.

For both vendors, the answer depends on the product, the edition and the add-on, not on the word Canada.

Meeting recordings are the weak point. Transcription, captioning and summarization often run in a different region from the recording, and the transcript may be stored separately. Ask which region processes the audio, not just which region stores the file.

Email has its own wrinkles. Journaling, eDiscovery and archiving may sit in a different region from the mailbox. If retention obligations require records to stay in Canada, the archive location matters as much as the inbox.

Selectors have limits. Some vendors offer a Canadian region only on certain plans, and some require a minimum seat count. Confirm the tier before assuming the selector applies to your contract. The email hosting arrangements you choose, shared, dedicated or self-run, change what the selector can promise.

If there is no selector, ask for the data centre location in writing. A support answer naming a city is weaker evidence than a console field, but it beats a logo. Keep the answer with your procurement file.

Shared Services Canada requirements for federal buyers

Shared Services Canada provides email and data centre services to federal departments. Its requirements shape what vendors must demonstrate, and a vendor selling to a department answers a standing set of enterprise conditions, not just your questions.

Those conditions cover security assessment, incident reporting and data location. Federal buyers should expect evidence of a security assessment, a documented incident response process, and a contractual commitment on where data is stored and processed.

The OPC publishes guidance for federal institutions on privacy obligations. That guidance feeds directly into how departments assess vendors and write retention terms.

Privacy obligations also shape what happens after a contract ends, so retention, deletion and return belong in the residency conversation.

The Canadian Centre for Cyber Security publishes advice federal buyers use in security assessments, and the Standards Council of Canada maintains standards that appear in procurement language. Neither replaces your own review, but both give you vocabulary for the questions.

Provincial buyers answer to a different regime, and that regime decides which questions matter.

Business and industry context shows a market where the federal government is a large buyer and where provincial health, education and municipal bodies each apply their own rules. A vendor's federal story may not transfer to a school board.

Security, reliability and AI features

For email, the controls underneath the claim matter as much as the location. The email hosting security you configure, DNS records, authentication and transport rules, determines whether a residency claim survives contact with a real threat.

Reliability is the other half of the test. A vendor hosting in Canada but handling failures poorly will still cost you. Judge providers on how they handle outages, not on the region name alone; the email hosting reliability question is separate and deserves its own review.

Run the same tests on meeting platforms, covering recordings, transcripts and any AI features attached to them. The market for ai meeting notes for canadian companies has moved quickly on AI features, and those features often process content outside the region that stores it.

When claims fail and what to write into the contract

Claims fail in predictable places: backups, support access, subprocessors and AI features. Each has a contract fix, and each fix is easier to negotiate before signature than after.

Backups are the first failure. A vendor may host primary data in Canada and replicate backups to another country for disaster recovery. Ask where backups live, how long they are retained, and whether they can be restored without leaving Canada.

Support access is the second. Remote sessions may route through staff or tooling outside Canada, and screen sharing can expose content. Ask whether support can be delivered by Canadian-based staff and whether remote sessions are logged.

Subprocessors are the third. The fix is a notice and objection clause: the vendor must tell you before adding a subprocessor that touches your content, and you must be able to object. Without that clause, your position is only as stable as the vendor's roadmap.

AI features are the fourth. Summarization, transcription and drafting tools may send content to a model hosted elsewhere. Ask which region processes the content and whether the feature can be disabled per tenant. Make the answer a contract term, not a help-centre article.

Write the region into the contract by name. Canada is too broad if your obligation is provincial. A model clause: "Provider will store and process Customer Data only in the Canadian region named in Schedule B. Covered workloads are email mailboxes, file storage, meeting recordings and transcripts, and the search index over them.

"Provider will not store or process that data outside the named region without Customer's prior written consent. Subprocessors permitted to reach Customer Data are listed in Schedule C, which forms part of this agreement. Customer may object on reasonable grounds to any addition, and Provider will not add that subprocessor while an objection stands."

Add exit terms. Data return in a usable format, certified deletion within a stated period, and a transition assistance window. Residency without exit rights leaves you dependent on the vendor's goodwill at the moment you have least bargaining power.

Set a review cadence. Residency claims age: vendors add regions, retire data centres and change subprocessors. An annual check against the trust page, the subprocessor list and your own logs keeps the claim honest. Put the review date in the contract calendar, not in someone's memory.

Common questions

Does a Canadian region mean my data never leaves Canada?

No. It means primary storage sits in the named region. Backups, support access, subprocessors and AI processing can still involve systems outside Canada unless the contract says otherwise.

What is the fastest way to test a residency claim?

Create a test tenant in the Canadian region, run email, a file share and a meeting recording through it, then check the audit log region field for each. It takes an afternoon and produces evidence you can file.

Do Shared Services Canada requirements apply to my organization?

They apply to federal departments and agencies served by Shared Services Canada. Provincial, municipal, health and education buyers usually fall under their own privacy regime instead.

How often should I recheck a vendor's residency position?

At least annually, and whenever the vendor notifies you of a subprocessor change or a new AI feature. Subprocessor lists and trust pages change more often than contracts.