How we judge Canadian digital services
Last verified:
Email, file storage, office suites, and password managers are not groceries. This page is the rubric for those comparisons. The physical-product score, including its weights and labels, stays on how we score Canadian origin.
Not a regulated claim, and not legal advice
A verdict band is fyiCanada's reading of pages the company published. It is not a finding by the Canadian Food Inspection Agency, the Competition Bureau, or a privacy regulator. Mentions of PIPEDA, Quebec's privacy law, or the US CLOUD Act describe what a vendor wrote. They are not legal advice.
What we look at
Six signals. Priority is High or Medium. These are not percentages, and they are not added into a score out of 100.
| Signal | Priority | What we verify |
|---|---|---|
| Ultimate ownership | High | Whether the operating company is Canadian and independent, or a subsidiary of a foreign parent. |
| Operating headquarters and workforce | Medium | Where the company says it is run from, and where it says the work is done. |
| Data residency default | High | Where customer data sits unless the customer picks another region. A Canada region on a foreign cloud is not the same as a Canadian operator. |
| Infrastructure control | High | Whether the company says it runs its own data centre, or rents a region from a hyperscaler such as Amazon Web Services, Google Cloud, or Microsoft Azure. A claim that the company owns its infrastructure is the company’s statement and is not independently audited. |
| Governing law and subprocessors | Medium | Which law the company says applies, and which subprocessors it names. This is not legal advice. |
| Research and development in Canada | Medium | Whether the company says the product is designed or built in Canada. |
Not used for software: Manufacturing, Packaging, Ingredients and material inputs. Those belong to physical goods.
Verdict bands
Each service gets one band. The band is the plain-language result. It is not a tier from the food rules.
| Band | What it means |
|---|---|
| Canadian-operated, data in Canada | The company says it is Canadian-owned and that customer data stays in Canada on infrastructure it controls. That infrastructure claim is the company’s own statement and is not independently audited. |
| Canadian-owned, hosted in Canada | The company says it is Canadian-owned and that data is hosted in Canada. It does not say it owns the building or the hardware. |
| Canadian company, region is a choice | A Canadian company, but where the data sits depends on the account you create. The company does not say it owns the data centre. |
| Foreign parent, data in Canada | Customer data is described as stored in Canada, and the parent company is not Canadian. |
| Foreign company, Canada region available | A foreign company that offers a Canada data region for some plans. That is not a Canadian operator. |
| Not a Canadian option | Owned and operated outside Canada. Listed so the comparison is complete. |
| No company hosts the data | The software keeps data in a file you control. It is not a Canadian service and it is not a foreign cloud. |
Confidence
Confidence sits next to the band. It says how direct the source was, not how Canadian the service is.
- High. The fact is on a primary page we opened, such as a privacy notice or a support article, and it is specific.
- Medium. The fact is on the company’s own site, usually a marketing or about page, and we did not check a corporate registry.
- Low. Only part of the claim is on a primary page, or the page is vague.
If a fact is missing from the company's own site, the cell says unverified or the fact is left out. We do not fill the gap from a blog roundup.
Corrections
Ownership and server regions change. The date at the top is the day the linked pages were opened. Corrections for the rest of the site are described on how corrections work.