Keeping Your Data in Canada: Hosting Custom Software and Private AI in Alberta

More Alberta organizations are asking a simple question before they approve a new system: will our data stay in Canada? Clients ask for it in contracts, health and legal work often depends on it, and AI has raised new concerns about where documents go once they are sent to a model.

The good news is that keeping data in Canada is now straightforward. Here is how it works, and what to ask before you build.

Canadian cloud regions are widely available

All three major cloud providers run data centres in Canada:

• Amazon Web Services: Canada Central in Montreal, and Canada West in Calgary, which opened in December 2023.
• Microsoft Azure: Canada Central in Toronto and Canada East in Quebec City.
• Google Cloud: Montreal and Toronto.

A custom application, its database, file storage, backups, and logs can all be configured to run only in these regions. For a Calgary business, the AWS Calgary region also means lower latency for staff and customers in Alberta.

What Canadian privacy law expects

Private-sector privacy laws in Canada, including PIPEDA federally and the Personal Information Protection Act (PIPA) in Alberta, generally do not ban storing personal information outside the country. They do make you accountable for protecting it, including when a vendor processes it for you, and they expect you to be open with people about how their information is handled.

Health information is handled more strictly. In Alberta, custodians covered by the Health Information Act have specific obligations around where health information is stored and who can access it. Public bodies have their own rules. Many organizations also have contracts that require Canadian residency regardless of the law.

This is not legal advice, and you should confirm your obligations with your own counsel. In practice, hosting in Canada removes a whole category of questions from privacy reviews, customer security questionnaires, and contract negotiations.

Private AI can stay in Canada too

AI is where data residency gets more complicated. Sending documents to a public chatbot, or to an API with unclear retention terms, can move sensitive information outside your control. A private AI setup avoids that:

• Enterprise model endpoints. Services such as Azure OpenAI and Amazon Bedrock offer models under enterprise terms where your prompts and documents are not used to train public models. Model availability differs by region, so confirm which models run in Canada before committing.
• Your search index stays with your data. The vector database that lets AI search your own files can run in the same Canadian region as the application.
• Access follows your permissions. A well-built system only lets AI see the documents the signed-in user is already allowed to see.
• Every AI action is logged. Prompts, sources, and outputs are recorded, so you can audit what the system did and why.

Questions to ask your software partner

• Which cloud region will host the application, database, files, and backups?
• Will any data, including logs and error reports, be sent outside Canada?
• Which AI models will we use, where do they run, and under what retention terms?
• Can our documents ever be used to train a model? (The answer should be no.)
• How is access controlled, and is AI activity logged?
• Who owns the cloud account, and can we take it over if we change vendors?

How we handle it at Calnetic

We build custom applications and private AI workflows on AWS, Microsoft Azure, and Google Cloud, and we can host them entirely in Canadian regions, including the AWS Calgary region. Our team works out of downtown Calgary, and we have built Canadian-hosted systems such as an operations CRM for Interior Care and a claims integration with Alberta Health Services. Learn more about our cloud infrastructure and AI automation work, or read about custom software development in Calgary.

Frequently asked questions