Data residency and AI in Canada

1. 01

   At rest

   the stored copy of your account, chat history, uploaded files and memory.

2. 02

   In processing

   the text a model reads to generate an answer.

3. 03

   In logs and backups

   copies kept for reliability, debugging or abuse monitoring.

A provider that says your data is stored in Canada is normally talking about data at rest. That matters: it decides where your history physically lives. But it is worth asking separately where processing happens and where logs and backups are kept.

The gap is real. Some large AI providers now offer Canadian storage on enterprise plans while the model that reads each prompt still runs in another country — and their free and consumer plans usually have no Canadian option at all.

1. 01

   Where are conversations and files stored at rest?

2. 02

   Which AI models process my prompts, where do they run, and who operates them?

3. 03

   Can I see and delete what the assistant remembers about me?

4. 04

   Is my content used to train models, and can I opt out?

5. 05

   Can I export or delete everything and leave?

6. 06

   Is there a self-hosted or dedicated option if we need full control?

Under PIPEDA, Canada’s federal private-sector privacy law, organisations may send personal information outside Canada for processing, but they remain accountable for it: they must protect it with contracts and other means, and be open with people that it may be processed abroad.

Québec’s Law 25 goes further: before communicating personal information outside Québec, a business must assess the privacy risks — including the protection offered where the data is going — and put a written agreement in place. Other provinces have their own rules. This guide is general information, not legal advice.

Sources OPC — processing personal data across borders · Commission d’accès à l’information — communication outside Québec