Web hosting
Your website's data lives somewhere: a Canadian data-sovereignty guide
Your website is not in "the cloud." It is a set of files on a computer, in a rack, in a building, in a specific country. Your email sits on a computer somewhere too. So do your backups. And the country those computers live in, plus the country the hosting company answers to, decides which laws can reach your data.
Most Canadian business owners have never been told where their site actually sits. This guide fixes that, in plain language. It is a general overview, not legal advice. If you handle health records, government work, or other regulated information, talk to a lawyer about your specific obligations.
The three piles of data you own
When someone says "my website is hosted in Canada," they usually mean one thing, but there are really three piles of data, and the three can sit in three different places.
First, your site files and database: the pages, images, orders, contact form entries, and customer accounts your site runs on.
Second, your email. Email is very often a separate service, on separate servers, sometimes run by a completely different company than the one hosting your site.
Third, your backups. A backup stored on the same server as your site protects you from a bad update. It does not protect you from losing the server itself. Good backups live somewhere else, and that somewhere else has a location too.
When you ask a host where your data lives, ask about all three piles. The honest answer is three answers.
Why the country matters
Data stored in a country is subject to that country's laws. That part is intuitive. What surprises people is that the company's home country can matter as much as the server's address.
The United States CLOUD Act, passed in 2018, says that a company under US jurisdiction can be compelled by US authorities to hand over data in its possession or control, even when that data is stored on servers outside the United States. In plain terms: if your host is a US company, or owned by one, US legal process can potentially reach your data even if the server itself sits in Canada.
That does not mean strangers are reading your email for fun. It means the legal exposure exists, requests can come with secrecy attached, and your own duties to your customers under Canadian privacy law, mainly PIPEDA for most businesses, sit on top of it. Some public sector, health, and institutional contracts in Canada go further and require data to stay in Canada outright, no exceptions.
For a bakery or a plumber, this may never become a practical problem. For anyone holding client lists, legal files, health-adjacent information, or member data for an organization, it is worth making a deliberate decision instead of an accidental one.
Five questions to ask any host, including us
You do not need a law degree to shop for hosting. You need five answers, ideally in writing.
- In what country are the servers that hold my site and database?
- Where are my backups stored, and in what country?
- Where is my email hosted, if you provide it?
- What country is your company based in, and are you owned by a foreign parent company?
- If a foreign government requested my data, what would you do, and would I be told?
A host that answers these cleanly is a host that has thought about it before you asked. A host that cannot answer the first three does not actually know where your business lives, and that is worth knowing before you hand over your customer data.
The part nobody mentions: your data also lives in your tools
Your host is only part of the picture. The contact form plugin that emails you submissions, the American email platform your newsletter runs on, the booking tool, the live chat widget, the analytics dashboard: each of these can hold copies of your customer data, in their own countries, under their own rules.
That is not an argument for ripping out tools you like. Plenty of Canadian businesses use American software with their eyes open, because it is the best tool for the job. The sovereignty question is not "is every byte in Canada." It is "do I know where the important data sits, and did I choose that on purpose." Your website and email are the foundation, because they hold the most and get asked about first. Start there, get those answers in writing, and you are ahead of most businesses your size.
How DotMoose does it
DotMoose is a Canadian company, based in Calgary, Alberta. Customer sites, databases, and email on our platform are hosted in Canada. Backups are kept in Canada as well, stored apart from the live servers. We bill in Canadian dollars, so there is no exchange rate surprise on renewal and no foreign billing relationship quietly attached to your account.
No honest host can promise that no government anywhere will ever come asking questions. What we can promise is plainer: your data sits in one country, under one legal system, with a Canadian company whose name you know, and if any of that ever changed, it would change in writing, up front, not in a footnote at the bottom of a renewal email.
The next step
If you do not know where your site lives today, fixing that costs nothing: ask your host the five questions above. If the answers bother you, moving is easier than it used to be. Our early Black Friday deal is on now: code FILL25 takes 80% off your first 4 monthly invoices (Shared hosting from C$5.99 a month, Managed WordPress from C$7.99 a month), then the regular flat Canadian price, and it ends November 30, 2026. Assisted migration is free for everyone, always, and your old site stays live until the new one checks out. Start at dotmoose.com.