For years, "sovereign cloud" has meant whatever a vendor needed it to mean. Usually it meant a data centre in Canada. The federal government has now written down a stricter definition, and it's a useful yardstick for any business deciding where sensitive workloads should live.
What Shared Services Canada said
In a notice to industry about its upcoming sovereign cloud procurement, Shared Services Canada (SSC) set two minimum requirements. Future sovereign cloud services must ensure that:
- Canada's data is processed, transmitted and stored exclusively within Canada; and
- the services remain at all times under the control of providers, including their ultimate parent corporations, that aren't subject to foreign laws allowing a foreign government to access the data, or compel action affecting it, without Canada's prior written consent.
The notice goes further. The open competition will be limited to small and medium-sized businesses, and bidders must show that neither they nor their parent company is subject to any foreign order that could compel access to, disclosure of or interruption of the service. Canada has invoked the national security exception, which takes this procurement outside the usual trade-agreement rules.
Why location isn't the whole answer
The second requirement is the one that matters. A data centre in Toronto or Montreal answers where the data sits. It doesn't answer who can be compelled to hand it over.
The U.S. CLOUD Act, passed in 2018, lets U.S. authorities require providers under U.S. jurisdiction to produce data in their possession, custody or control, regardless of where it's stored. In June 2025, a Microsoft France executive told a French Senate inquiry, under oath, that he could not guarantee customer data would never be handed to U.S. authorities without French consent. He added that it had never happened. The point wasn't that it had; it's that the provider couldn't promise it wouldn't.
That is exactly the gap SSC's second requirement is written to close.
Five questions to ask your own provider
You don't need to be a federal department to use the same test:
- Where is the data processed, stored and backed up? Include disaster recovery copies and logs, not just the primary region.
- Where is it administered from? Remote support from outside Canada can count as access.
- Who owns the provider, all the way up? Check the ultimate parent company and the laws it answers to.
- Who holds the encryption keys? If the provider holds them, the provider can be compelled to use them.
- What does the contract say about government requests? Will you be told, and can the provider challenge them?
Not every workload needs this
Most business systems are fine on a mainstream public cloud with Canadian data residency. Sovereignty matters most for regulated data, public-sector and defence work, health information, and anything a client contract says must stay under Canadian control. The skill is knowing which workloads fall into which group, and not paying a sovereignty premium for the ones that don't.
How we help
We help Canadian organizations sort their workloads by how much control they really need, and place the sensitive ones on private, Canadian-controlled infrastructure, without moving everything else. If a client, regulator or contract is asking where your data lives and who can reach it, book a discovery call.