Settings
DT

Where your data
really lives

Residency and jurisdiction scored on two separate axes, the way Canadian law reads. A Canadian data centre does not stop a US subpoena.
Controls passing0%
Sovereign vendors33%
Residency only50%
Full exposure17%
0/87Controls
0Vendors
0Findings

Sovereignty matrix

CORE
RESIDENCY ONLY
data in Canada, US operator
FULL US EXPOSURE
SOVEREIGN
Canadian data + control
CONTROLLED OFFSHORE
Acomba
Dayforce
Microsoft 365
AWS ca-central
US analytics
CA hosting
OPERATOR: US-compellable ↑
DATA RESIDENCY: in Canada ← → outside Canada

Law 25 readiness

0%
READY
9 of 12 obligations met

Readiness by area

control coverage
CNS
BRC
INV
XBR
DEC
VND

Findings

2/5
US analytics, full exposure
US analytics · confirmed
Acomba, sovereign, no action
Acomba · confirmed
Payroll operator, US jurisdiction
Dayforce · indicative
Microsoft 365 residency add-on
Microsoft 365 · indicative
Infra operator compellable
AWS ca-central · indicative
Scans seed findings as indicative. They promote to confirmed only through analyst sign-off, so nothing false reaches the register.

Control coverage

Law 25
Consent management96%
Breach response88%
Data inventory74%
Cross-border transfer58%

Vendor roster

6 systems · jurisdiction checked
VENDORRESIDENCYOPERATOR
A
Acomba
Accounting · ACCEO, Quebec City
CanadaCA controlledSovereign
D
Dayforce
Payroll · HR
CanadaUS parentResidency only
M
Microsoft 365
Productivity
MixedUSConditional
U
US analytics SaaS
Analytics
USUSFull exposure

Cross-border
exposure

Two questions Vanta and Drata merge into one residency checkbox: where the data sits, and who can be compelled to disclose it. MapleGuard scores both and never collapses them.

Sovereignty matrix, full view

hover any vendor
RESIDENCY ONLY
data in Canada, US operator
FULL US EXPOSURE
SOVEREIGN · Canadian data and control
CONTROLLED OFFSHORE
Acomba
Dayforce
Microsoft 365
AWS ca-central
US analytics
CA hosting
US-compellable ↑
DATA RESIDENCY: in Canada ← → outside Canada

Vendors, by
jurisdiction

Every system that touches personal information, split by where the data lives and who can be legally compelled to hand it over.
VENDORRESIDENCYOPERATOR
A
Acomba
Accounting · ACCEO, Quebec City
CanadaCA controlledSovereign
C
Canadian hosting
Hosting
CanadaCA controlledSovereign
D
Dayforce
Payroll · HR
CanadaUS parentResidency only
A
AWS ca-central-1
Infrastructure
CanadaUSResidency only
M
Microsoft 365
Productivity
MixedUSConditional
U
US analytics SaaS
Analytics
USUSFull exposure

Law 25
(Loi 25)

Every cross-border finding ties back to a specific obligation, in French and English, so the register reads cleanly in an audit.

Obligation readiness

9 of 12 met
Consent and transparency96%
Confidentiality incidents88%
Data inventory74%
Cross-border transfer58%

Live obligation register

FR / EN
Privacy officer designated and publishedart. 3.1
Confidentiality incident log maintainedart. 3.5
Transfer outside Quebec assessed per systemart. 17
Automated decision factors disclosedart. 12.1

PHIPA

Health information custody, with the same jurisdiction lens applied to every vendor that touches a record.

Safeguard readiness

personal health information
Access controls and audit log91%
Custodian agreements80%
Breach notification workflow86%
Vendor jurisdiction reviewed69%