EN|FR
Solutions
Resources
“Hosted in Canada” answers where your call data sits, not who controls it. This guide covers data residency vs. data sovereignty, what PIPEDA, Law 25 and the CLOUD Act mean for AI phone calls, the four levels of sovereignty and nine questions to ask any voice AI provider.
When a voice AI provider tells you your data is “hosted in Canada,” it's answering one question, where the data sits. Data sovereignty in Canada asks a bigger one. Who controls that data, which country's laws apply to it, and who could be forced to hand it over? For AI phone calls, the answer is rarely simple, because one call passes through several technologies, often run by different companies. Here's how to make sense of it.
The Government of Canada defines data sovereignty as “Canada's right to control access to and disclosure of its digital information,” subject only to Canadian laws (Government of Canada, 2018). For a business, the same idea applies to its own data and its customers' data. Who can access it, who can be forced to hand it over, and under which country's rules?
Sovereignty has become a national priority. Canada's AI strategy, released in June 2026, makes building “the Canadian sovereign AI foundation” one of its six pillars, and notes that “Canadian companies store sensitive data in foreign jurisdictions” (AI for All, 2026).
Data residency is about location. The data is stored, and ideally processed, in Canada. Data sovereignty is about control. The data is held by an organization that answers only to Canadian law, with access and keys controlled in Canada.
A voice AI provider can offer residency without sovereignty. If it rents Canadian servers from a US-owned cloud company, the data sits in Canada but the cloud company may still be compelled by US authorities to produce it. The federal government's own framework makes this clear. Storing data in Canada does not guarantee it stays outside foreign courts' reach (Government of Canada, 2025).
| Data residency | Data sovereignty | |
|---|---|---|
| The question it answers | Where is the data? | Who controls the data? |
| What it covers | Storage and processing location | Ownership, legal jurisdiction, access and encryption keys |
| Typical proof | “Hosted in Canada” | Canadian-controlled provider, Canadian access and client-held keys |
| Protects against foreign legal requests | Not on its own | Reduces exposure, depending on the setup |
A single AI phone call creates at least nine kinds of data, and each one can be handled by a different provider in a different country. Sovereignty only holds if every one of them stays under Canadian control. To see how these components fit together on a call, read how voice AI works.
| Data created by one call | Where it usually goes | What to ask the provider |
|---|---|---|
| Live call audio | The phone carrier, then the agent's servers | Which carrier is used, and where are its servers? |
| Live transcript | The speech-to-text provider | Is speech-to-text run in Canada? |
| What the caller said, plus customer data pulled from your CRM | The language model provider | Is the model run in Canada, or called through a foreign API? |
| The agent's spoken reply | The text-to-speech provider | Is text-to-speech run in Canada? |
| The call recording | Storage | Where is it stored, and for how long? |
| Transcript and summary after the call | The platform's database and your CRM | Where is the database? |
| Logs and monitoring data | Monitoring tools, sometimes third parties | Do logs contain caller details, and where are they kept? |
| Backups | A backup location | Are backups in Canada too? |
| Support and admin access | The provider's staff and subcontractors | From which countries can people access our data? |
The language model is a frequent blind spot. A platform can store recordings in Canada and still send each turn of the conversation to a model hosted in the United States. The data is “stored in Canada” and still leaves the country several times per call.
This is also why the choice of architecture matters. With an open stack, each part can be chosen for where it runs, not only for how well it performs.
No Canadian law forbids sending call data outside the country. What the law does require is that you stay accountable for it, tell people about it and, in Quebec, assess the risks before it leaves.
PIPEDA, the federal private-sector privacy law, does not prohibit transferring personal information to a provider in another country for processing. The business that collected the data remains accountable for it, must ensure a comparable level of protection through its contract with the provider, and should tell people that their information may be processed abroad and accessed by foreign courts and authorities (Office of the Privacy Commissioner, 2009).
Since September 22, 2023, a business must complete a privacy impact assessment before personal information collected in Quebec is sent outside the province, including to another Canadian province. The assessment weighs the sensitivity of the information, why it is used, the protections in place and the legal framework of the destination. The transfer can go ahead only if the information will be adequately protected, under a written agreement (McCarthy Tétrault).
For voice AI, this means every provider in the call path that sits outside Quebec is part of the assessment.
Bill C-36, introduced on June 15, 2026, would replace the private-sector part of PIPEDA with a new Protecting Privacy and Consumer Data Act. Among other changes, it would require a privacy impact assessment before transferring personal information outside Canada, and raise penalties to as much as $10 million or 3% of global revenue, and up to $25 million or 5% for the most serious offences. As of October 2026, it is still a bill, not law (Gowling WLG). Its predecessor, Bill C-27, died when Parliament was prorogued in January 2025.
Some sectors and public bodies face stricter rules, such as provincial health privacy laws and data-location requirements in some public-sector contracts. If you work in health care, finance or with government clients, check your sector's rules before choosing a provider.
The US CLOUD Act (2018) lets US authorities compel a company under US jurisdiction to produce data in its “possession, custody or control,” even when that data is stored outside the United States. That can include a Canadian subsidiary substantially controlled by a US parent. A Canadian company wholly owned and managed in Canada generally falls outside its scope (BLG, 2026). For voice AI, the question is not only where the servers are, but who owns every provider in the call path.
Sovereignty is not a yes-or-no label. It builds up in four levels, and each one closes a gap the previous level leaves open.
Complete sovereignty is out of reach, even for governments. The federal government's own framework states that “it is impossible for the GC to obtain a state of complete digital sovereignty,” given how interconnected digital systems are. The same framework notes that the government “could find no documented cases of foreign governments seeking access to the data of Canadian enterprises” held by suppliers (Government of Canada, 2025).
The practical answer is a risk-based one. Match the level of sovereignty to the sensitivity of your calls.
| Type of calls | Level to aim for |
|---|---|
| General inquiries, opening hours and simple bookings | Level 1 or 2 |
| Customer accounts, payments and personal details | Level 2 at minimum |
| Health information, legal or financial files | Level 3 |
| Government or public-sector clients | Level 3 or 4, per contract |
“Hosted in Canada” on a website is a starting point, not an answer. These nine questions show which level a provider really reaches.
A provider that answers all nine clearly, in writing, is one you can assess against your clients' requirements and your auditors' expectations.
Vatel fully complies with Quebec's Law 25. By default, a Vatel agent uses providers in the US and Europe. For clients who need it, Vatel can set up an agent so that hosting, speech-to-text, the language model and the voice all run in Canada, which reaches level 2.
Vatel can also connect through the phone carrier you already use, so the phone line can stay Canadian too. Zero Data Retention is available at the speech and voice providers. Retention is configurable from 24 hours to 2 years, recordings can be turned off for sensitive calls, and all data is encrypted in transit and at rest.
You keep ownership of your data, the full list of subprocessors is public, and identifiable call data is never used to train models. Vatel's terms are governed by Quebec law, and a data processing agreement is available to support your privacy impact assessment. SOC 2 Type II and ISO 27001 certifications are in progress.
Want to see where each part of a Vatel call runs? Book a demo
Another question? sales@vatel.ai
No. PIPEDA allows personal information to be processed outside Canada, but the business stays accountable for it, must protect it through contracts and should tell people it may be processed abroad.
No. It requires a privacy impact assessment before the transfer and a written agreement, and the transfer can go ahead only if the information will be adequately protected.
It provides residency, not full sovereignty. The data sits in Canada, but the provider is a US company and can be subject to US legal orders such as the CLOUD Act. Client-held encryption keys reduce that risk.
It depends on the calls. For general inquiries, Canadian storage and processing is usually enough. If callers share health, financial or legal details, or if your clients require it in their contracts, aim higher.
A sovereign cloud is cloud infrastructure owned, operated and controlled within one country, under that country's laws, so that foreign authorities cannot compel access to the data it holds.