Data sovereignty.

Data sovereignty matters because cloud providers headquartered in the United States are subject to the CLOUD Act, which allows U.S. law enforcement to compel disclosure of data regardless of where it is physically stored. For Canadian federal government, Quebec public sector under Law 25, and regulated industries like banking and healthcare, this is often a hard constraint that rules out U.S.-headquartered SaaS even when their Canadian region is technically available. Practical responses include selecting Canadian-headquartered providers, deploying self-hosted infrastructure in Canadian data centres, or — for high-stakes data — keeping it on-premises entirely. Quebec’s Law 25 specifically requires privacy impact assessments before transferring personal information outside Quebec.