Personal data vault Canada/Guide
Canadian data sovereignty and your personal data vault
Data sovereignty means your data is governed by the laws of the country where it is stored and by the jurisdiction of the company that controls it. For a personal data vault, both matter: Canadian residency keeps your documents physically in Canada, and a Canadian provider keeps them under Canadian law. my-id.ca stores user data and backups in Canada, runs its AI on its own Canadian infrastructure, and designs its privacy practices to comply with PIPEDA.
Residency is where data sits; jurisdiction is who can demand it
Data residency is a physical fact: which country holds the servers. Jurisdiction is a legal fact: which governments can compel the company that controls the data. A US-headquartered cloud can store your files in Toronto and still be subject to US legal process for data it controls, because jurisdiction follows the company, not the disk.
That is why "hosted in Canada" on its own is an incomplete promise. For personal documents — passports, SINs, medical letters, kids’ records — the stronger position is Canadian residency and a Canadian provider, so both the data and the company answer first to Canadian law.
Where my-id.ca data actually lives
my-id.ca stores user data on servers hosted in Canada. Backups are kept in the same jurisdiction, and we do not routinely replicate user data outside Canada. Data is encrypted at rest with AES-256-GCM and in transit with TLS.
The AI features — vault search, PDF fill, and web-form fill — run on infrastructure my-id.ca operates. Nothing is sent to OpenAI, Google, Anthropic, or other third-party AI providers, so sovereignty is not quietly lost at the AI layer. Our Trust page lists the narrow exceptions honestly: Stripe for payments, Google only if you choose Google sign-in, and an email provider for transactional email.
Questions to ask any vault about sovereignty
Whatever provider you choose, four questions surface most of the truth:
- Where are the primary servers and the backups — and does any replication leave Canada?
- Where is the company headquartered, and whose legal process is it subject to?
- Where do AI features process content — on the provider’s own servers or via a US AI API?
- Which sub-processors receive any slice of data, and is the list published?
Frequently asked questions
Does Canadian hosting alone make my data sovereign?
No. If the provider is controlled by a foreign company, foreign legal process may still reach data it controls regardless of where the servers sit. Sovereignty needs both Canadian residency and a provider under Canadian jurisdiction.
Do my-id.ca backups stay in Canada?
Yes. Primary storage and backups are hosted in Canada, and user data is not routinely replicated outside Canada. See the Trust page for the current statement.
Do AI features change the sovereignty picture?
Often, yes — many products store documents in Canada but send content to US-based AI APIs for search or extraction. my-id.ca runs AI search and form filling on its own infrastructure in Canada, so AI does not move your data out of the country.
Is this legal advice?
No — this article is general information about how residency and jurisdiction interact. For advice about your specific situation, consult a lawyer.
Verify everything on the Trust page
Every claim about my-id.ca in this guide — hosting, encryption, sub-processors, deletion, breach commitments — is documented on the Trust page, which is the source of truth. Related reading: personal data vault Canada.
Store it once. In Canada. For free.
Create a free my-id.ca account — no credit card — and build the vault that powers your family's forms, PDFs, and document sharing.