{
    "meta": {
        "title": "D-Central — Canada AI Cloud Residency & CLOUD Act Exposure Index",
        "description": "Mapping of 22 AI/cloud providers against Canadian data-residency availability, US control status, CLOUD Act exposure, and Quebec Law 25 posture. As of June 2026. NOT legal advice.",
        "version": "1.0",
        "date_as_of": "2026-06-15",
        "license": "https://creativecommons.org/licenses/by/4.0/",
        "license_name": "CC BY 4.0",
        "source": "https://d-central.tech/data/canada-ai-cloud-residency/",
        "record_count": 22,
        "disclaimer": "Informational only. NOT legal advice. Policies change; verify at source before procurement decisions."
    },
    "rows": [
        {
            "provider": "Amazon Web Services (AWS)",
            "hq_country": "United States",
            "ca_region_available": true,
            "us_controlled": true,
            "cloud_act_exposure": "high",
            "law25_posture_note": "Canadian regions available: ca-central-1 (Montreal) and ca-west-1 (Calgary). Data residency does not eliminate CLOUD Act exposure; TIA required under Law 25. AWS publishes a CLOUD Act compliance page confirming subject status as a US corporation. Authorized Government of Canada cloud provider for Protected B workloads.",
            "policy_url": "https://aws.amazon.com/compliance/cloud-act",
            "last_verified": "2026-06",
            "notes": "US corporation (Seattle, WA). CLOUD Act (18 U.S.C. § 2713) applies regardless of server location in Canada. AWS Bedrock in ca-central-1 provides Canadian-region inference for foundation models. Storing data in Canadian regions satisfies data residency but does not confer legal sovereignty."
        },
        {
            "provider": "Microsoft Azure",
            "hq_country": "United States",
            "ca_region_available": true,
            "us_controlled": true,
            "cloud_act_exposure": "high",
            "law25_posture_note": "Canada Central (Toronto) and Canada East (Quebec City) regions. Microsoft Data Residency commitments available for Enterprise tier. TIA required under Law 25; Microsoft documentation acknowledges CLOUD Act exposure. Microsoft has publicly stated US law supersedes Canadian data residency commitments when a valid CLOUD Act order is issued. C$19B Canadian AI/cloud investment committed 2023-2027.",
            "policy_url": "https://learn.microsoft.com/en-us/azure/compliance/offerings/offering-canada-privacy-laws",
            "last_verified": "2026-06",
            "notes": "US corporation (Redmond, WA). Azure OpenAI Service available in Canada Central for AI inference workloads. CLOUD Act applies as US entity regardless of Canadian data centre location."
        },
        {
            "provider": "Google Cloud Platform (GCP)",
            "hq_country": "United States",
            "ca_region_available": true,
            "us_controlled": true,
            "cloud_act_exposure": "high",
            "law25_posture_note": "northamerica-northeast1 (Montreal) and northamerica-northeast2 (Toronto). Google publishes a dedicated Quebec Law 25 compliance page. TIA required under Law 25. Client-Side Encryption (CSE) for Workspace available as technical mitigation but does not eliminate CLOUD Act exposure via US parent. AI inference processing may occur outside configured region depending on service configuration.",
            "policy_url": "https://cloud.google.com/security/compliance/quebeclaw25",
            "last_verified": "2026-06",
            "notes": "US corporation (Mountain View, CA). Vertex AI available in Canadian regions. CLOUD Act applies as US entity. Data residency configuration satisfies physical location requirement but not legal sovereignty."
        },
        {
            "provider": "Oracle Cloud Infrastructure (OCI)",
            "hq_country": "United States",
            "ca_region_available": true,
            "us_controlled": true,
            "cloud_act_exposure": "high",
            "law25_posture_note": "Toronto (ca-toronto-1) and Montreal (ca-montreal-1) regions. OCI awarded Government of Canada Framework Agreement for Protected B cloud services. TIA required under Law 25. OCI Generative AI service availability in Canadian regions changes frequently; verify at source before AI workload deployment.",
            "policy_url": "https://www.oracle.com/legal/privacy/privacy-policy.html",
            "last_verified": "2026-06",
            "notes": "US corporation (Austin, TX). Toronto and Montreal regions support multi-region Canadian deployments. CLOUD Act applies as US entity."
        },
        {
            "provider": "IBM Cloud",
            "hq_country": "United States",
            "ca_region_available": true,
            "us_controlled": true,
            "cloud_act_exposure": "high",
            "law25_posture_note": "Toronto Multizone Region (MZR) live; Montreal MZR announced April 2024 (targeted H1 2025 opening). IBM markets Canadian MZRs for regulated-industry compliance including Protected B. TIA required under Law 25 as US corporation. IBM documented Canadian data commitments may factor into TIA risk analysis but do not eliminate CLOUD Act exposure.",
            "policy_url": "https://www.ibm.com/privacy",
            "last_verified": "2026-06",
            "notes": "US corporation (Armonk, NY). IBM watsonx AI portfolio available on IBM Cloud Canadian MZRs. Positions Canadian infrastructure for financial services and government workloads. CLOUD Act applies as US entity."
        },
        {
            "provider": "Cloudflare Workers AI",
            "hq_country": "United States",
            "ca_region_available": false,
            "us_controlled": true,
            "cloud_act_exposure": "high",
            "law25_posture_note": "No dedicated Canadian inference zone for AI workloads as of June 2026. CDN edge presence globally but Canadian AI inference region targeting not confirmed. Custom Regions feature announced March 2026 for data routing but Canadian AI inference zone not documented. TIA required under Law 25 as US corporation. Verify current AI regional availability at source before deployment.",
            "policy_url": "https://www.cloudflare.com/privacypolicy/",
            "last_verified": "2026-06",
            "notes": "US corporation (San Francisco, CA). Workers AI offers edge inference; inference runs on nearest available edge node which may not be in Canada. No confirmed Canadian-region AI inference guarantee as of June 2026."
        },
        {
            "provider": "OpenAI API",
            "hq_country": "United States",
            "ca_region_available": false,
            "us_controlled": true,
            "cloud_act_exposure": "high",
            "law25_posture_note": "No dedicated Canadian API region. Enterprise and Education tiers offer EU data residency; no Canadian data residency option publicly announced as of June 2026. OPC and provincial privacy regulators found ChatGPT training practices violated Canadian federal and provincial privacy laws (investigation concluded 2024). TIA required under Law 25.",
            "policy_url": "https://openai.com/policies/privacy-policy",
            "last_verified": "2026-06",
            "notes": "US corporation (San Francisco, CA). Data processed in US. Enterprise tier allows EU data residency; no Canadian region offered. CLOUD Act applies. Canadian privacy regulators' 2024 finding of privacy law violations during model training is a distinct compliance consideration from data residency."
        },
        {
            "provider": "Anthropic Claude API (direct)",
            "hq_country": "United States",
            "ca_region_available": false,
            "us_controlled": true,
            "cloud_act_exposure": "high",
            "law25_posture_note": "No dedicated Canadian region on the direct Anthropic API platform as of June 2026. Claude models available via AWS Bedrock (ca-central-1, Montreal), enabling Canadian-region inference — but CLOUD Act applies to both Anthropic (US corp) and AWS (US corp). TIA required under Law 25 for either delivery path.",
            "policy_url": "https://www.anthropic.com/legal/privacy",
            "last_verified": "2026-06",
            "notes": "US corporation (San Francisco, CA). Direct Anthropic API routes to US infrastructure. Canadian-region inference achievable via AWS Bedrock as a separate delivery channel; verify current Bedrock model availability in ca-central-1 before production deployment."
        },
        {
            "provider": "CoreWeave",
            "hq_country": "United States",
            "ca_region_available": true,
            "us_controlled": true,
            "cloud_act_exposure": "high",
            "law25_posture_note": "CA-East-01 (Ontario) available as a dedicated-access region (not self-serve) as of June 2026. Bell Canada 300 MW campus in Saskatchewan (CoreWeave anchor tenant) expected earliest H1 2027. TIA required under Law 25 as US corporation.",
            "policy_url": "https://www.coreweave.com/trust",
            "last_verified": "2026-06",
            "notes": "US corporation (Roseland, NJ). GPU-as-a-Service neocloud purpose-built for AI inference and training. Ontario region requires dedicated onboarding; contact CoreWeave sales to confirm current access model. CLOUD Act applies as US entity."
        },
        {
            "provider": "OVHcloud (Canadian operations)",
            "hq_country": "France",
            "ca_region_available": true,
            "us_controlled": false,
            "cloud_act_exposure": "low",
            "law25_posture_note": "Beauharnois, Quebec data centres (BHS1-BHS5+) and Cambridge, Ontario facility (opened 2025). OVHcloud SAS (French parent entity) states it is not subject to US CLOUD Act or FISA. OVH US LLC (US subsidiary) may be separately subject; verify the legal entity on your service contract. Beauharnois QC location may satisfy Law 25 data residency if contracting entity is the French parent.",
            "policy_url": "https://www.ovhcloud.com/en-ca/personal-data-protection/",
            "last_verified": "2026-06",
            "notes": "French company (OVHcloud SAS, Roubaix, France). Largest EU-headquartered cloud provider with significant Canadian capacity. Ontario Court of Justice (2024) ordered OVHcloud to disclose Canadian customer data via Canadian judicial process — distinct from CLOUD Act. Sovereign cloud claims depend on French parent legal entity; verify your service agreement carefully."
        },
        {
            "provider": "ThinkOn",
            "hq_country": "Canada",
            "ca_region_available": true,
            "us_controlled": false,
            "cloud_act_exposure": "none",
            "law25_posture_note": "Canadian-owned and operated. Data centres in Canada. Not subject to foreign data access laws per ThinkOn sovereign cloud product positioning. Law 25: Canadian jurisdiction throughout; no inter-jurisdictional TIA required for data remaining in ThinkOn Canadian facilities operated by a Canadian entity. Specific AI workload capabilities should be verified directly with ThinkOn.",
            "policy_url": "https://thinkon.com/sovereign-cloud/",
            "last_verified": "2026-06",
            "notes": "Canadian company (Toronto, ON). Purpose-built sovereign cloud for regulated industries. VMware-based and hyperscaler-adjacent managed services. As a Canadian corporation operating Canadian infrastructure, ThinkOn claims full exemption from CLOUD Act and foreign data access laws."
        },
        {
            "provider": "Snowflake (Cortex AI)",
            "hq_country": "United States",
            "ca_region_available": true,
            "us_controlled": true,
            "cloud_act_exposure": "high",
            "law25_posture_note": "Canadian regions available: ca-central.aws (Montreal) and ca-west.aws (Calgary). Snowflake Cortex AI LLM functions available in select regions; verify Canadian region Cortex AI availability against current Snowflake documentation before production deployment. TIA required under Law 25 as US corporation.",
            "policy_url": "https://www.snowflake.com/legal/privacy-policy/",
            "last_verified": "2026-06",
            "notes": "US corporation (Bozeman, MT). AI Data Cloud with Cortex AI functions including LLM inference. Canadian regions confirmed in Snowflake region documentation. CLOUD Act applies as US entity. Cortex AI feature availability in Canadian regions may lag US regions."
        },
        {
            "provider": "Databricks",
            "hq_country": "United States",
            "ca_region_available": true,
            "us_controlled": true,
            "cloud_act_exposure": "high",
            "law25_posture_note": "Available via AWS Canada (ca-central-1) and Azure Canada Central. Databricks workloads inherit the CLOUD Act exposure of the underlying hyperscaler (AWS or Azure — both US corporations). TIA required under Law 25. Verify current Canadian region support and Mosaic AI feature availability in Canadian regions at Databricks documentation.",
            "policy_url": "https://www.databricks.com/legal/privacynotice",
            "last_verified": "2026-06",
            "notes": "US corporation (San Francisco, CA). Unified data analytics and AI platform (Mosaic AI). Deploys on AWS, Azure, GCP; Canadian region availability follows hyperscaler Canadian regions. CLOUD Act applies via US parent and US-controlled underlying infrastructure."
        },
        {
            "provider": "Cohere",
            "hq_country": "Canada",
            "ca_region_available": false,
            "us_controlled": false,
            "cloud_act_exposure": "moderate",
            "law25_posture_note": "Canadian company (Toronto HQ); not directly subject to CLOUD Act as a Canadian corporation. No dedicated Canadian data-residency option publicly documented as of June 2026. Cohere inference infrastructure is deployed on third-party cloud (likely US-based hyperscalers), which introduces CLOUD Act exposure at the infrastructure layer. TIA under Law 25 recommended; verify infrastructure provider details with Cohere enterprise team.",
            "policy_url": "https://cohere.com/privacy",
            "last_verified": "2026-06",
            "notes": "Canadian corporation (Toronto, ON). Enterprise LLM/NLP API provider. As a Canadian legal entity, Cohere itself is not subject to the CLOUD Act. However, underlying inference infrastructure may be US-controlled cloud. Marked Moderate to reflect Canadian entity status offset by unconfirmed infrastructure sovereignty."
        },
        {
            "provider": "DigitalOcean",
            "hq_country": "United States",
            "ca_region_available": true,
            "us_controlled": true,
            "cloud_act_exposure": "high",
            "law25_posture_note": "TOR1 region (Toronto, Ontario) available. GPU Droplets for AI/ML available in select regions; verify Toronto region AI compute availability before deployment. TIA required under Law 25 as US corporation.",
            "policy_url": "https://www.digitalocean.com/legal/privacy-policy",
            "last_verified": "2026-06",
            "notes": "US corporation (New York, NY). General-purpose cloud with GPU compute offerings. TOR1 Toronto region confirmed. CLOUD Act applies as US entity. Verify current GPU availability in TOR1 for AI workloads."
        },
        {
            "provider": "Vultr",
            "hq_country": "United States",
            "ca_region_available": true,
            "us_controlled": true,
            "cloud_act_exposure": "high",
            "law25_posture_note": "Toronto location available. Vultr Cloud GPU available for AI workloads. TIA required under Law 25 as US corporation.",
            "policy_url": "https://www.vultr.com/legal/privacy/",
            "last_verified": "2026-06",
            "notes": "US corporation (Matawan, NJ). Cloud infrastructure with NVIDIA GPU compute for AI inference and training. Toronto data centre confirmed. CLOUD Act applies as US entity. Verify current GPU availability and Toronto region AI service options at Vultr documentation."
        },
        {
            "provider": "Hetzner Cloud",
            "hq_country": "Germany",
            "ca_region_available": false,
            "us_controlled": false,
            "cloud_act_exposure": "none",
            "law25_posture_note": "No Canadian region. EU (Germany, Finland) and US (Virginia) data centres. German company; not subject to US CLOUD Act. Data transferred to Hetzner leaves Canada — TIA required under Law 25 for the cross-border transfer to a non-Canadian jurisdiction.",
            "policy_url": "https://www.hetzner.com/legal/privacy-policy",
            "last_verified": "2026-06",
            "notes": "German company (Gunzenhausen, Bavaria). EU-native provider with cost-effective dedicated GPU servers (H100, A100 available). No Canadian region; data does not remain in Canada when hosted on Hetzner. GDPR jurisdiction. Not CLOUD Act exposed."
        },
        {
            "provider": "Nebius AI",
            "hq_country": "Netherlands",
            "ca_region_available": false,
            "us_controlled": false,
            "cloud_act_exposure": "none",
            "law25_posture_note": "No Canadian region as of June 2026. EU (Amsterdam) and US (Oregon) data centres. Dutch company; not subject to US CLOUD Act for data processed by Dutch entity. Data transferred to Nebius requires TIA under Law 25 for the cross-border transfer.",
            "policy_url": "https://nebius.com/legal/privacy-policy",
            "last_verified": "2026-06",
            "notes": "Dutch company (Amsterdam HQ; formerly Yandex Cloud Europe, rebranded 2024). Independent European AI cloud, H100 GPU compute available. No Canadian region. Not CLOUD Act exposed as Dutch entity. Verify current ownership structure and regional availability at source."
        },
        {
            "provider": "Hugging Face (Inference Endpoints)",
            "hq_country": "United States",
            "ca_region_available": false,
            "us_controlled": true,
            "cloud_act_exposure": "high",
            "law25_posture_note": "No dedicated Canadian inference region for Inference Endpoints as of June 2026. US and EU-region options available. TIA required under Law 25 as US corporation. Inference Endpoints deploy on AWS/Azure/GCP back-end, which independently carry CLOUD Act exposure.",
            "policy_url": "https://huggingface.co/privacy",
            "last_verified": "2026-06",
            "notes": "US corporation (New York, NY; Delaware incorporation). Hub for open-source and proprietary models; Inference Endpoints for production deployment on managed infrastructure. No confirmed Canadian-region endpoint option. CLOUD Act applies as US entity."
        },
        {
            "provider": "Mistral AI (La Plateforme)",
            "hq_country": "France",
            "ca_region_available": false,
            "us_controlled": false,
            "cloud_act_exposure": "none",
            "law25_posture_note": "No Canadian region. EU-based inference (France). French company; not subject to US CLOUD Act via direct API. Data transferred to Mistral for processing leaves Canada — TIA required under Law 25. Note: Mistral models also available via Azure AI Foundry, in which case Azure's CLOUD Act exposure applies to that delivery path.",
            "policy_url": "https://mistral.ai/en/privacy-policy",
            "last_verified": "2026-06",
            "notes": "French company (SAS Mistral AI, Paris). Frontier AI model provider with open-weight (Mistral 7B, Mixtral, Codestral) and proprietary models. EU inference infrastructure. Not CLOUD Act exposed via direct API. GDPR jurisdiction."
        },
        {
            "provider": "Scaleway",
            "hq_country": "France",
            "ca_region_available": false,
            "us_controlled": false,
            "cloud_act_exposure": "none",
            "law25_posture_note": "No Canadian region. EU data centres (Paris, Amsterdam, Warsaw). French company (Iliad Group subsidiary); not subject to US CLOUD Act. Data transferred to Scaleway requires TIA under Law 25 for cross-border transfer.",
            "policy_url": "https://www.scaleway.com/en/privacy-policy/",
            "last_verified": "2026-06",
            "notes": "French company (Paris HQ, subsidiary of Iliad Group). EU-native cloud provider with H100 GPU compute. Positioned as EU-sovereign alternative to US hyperscalers. No Canadian region. Not CLOUD Act exposed. GDPR jurisdiction."
        },
        {
            "provider": "Cerebras Cloud",
            "hq_country": "United States",
            "ca_region_available": false,
            "us_controlled": true,
            "cloud_act_exposure": "high",
            "law25_posture_note": "No Canadian region as of June 2026. US inference only. Bell Canada 300 MW campus in Saskatchewan names Cerebras as an anchor tenant; that facility is expected earliest H1 2027 and does not constitute a current Canadian region. TIA required under Law 25 as US corporation.",
            "policy_url": "https://cerebras.ai/privacy-policy",
            "last_verified": "2026-06",
            "notes": "US corporation (Sunnyvale, CA). Wafer-scale AI compute for ultra-fast LLM inference. No Canadian region currently. Bell Canada Saskatchewan campus (announced 2025, ~300 MW) will provide future Canadian GPU capacity with Cerebras as tenant; target earliest H1 2027. CLOUD Act applies as US entity."
        }
    ]
}