AWS security and Canadian data residency: know where your data lives.
Least-privilege IAM, secrets kept out of environment variables and source control, encryption where it genuinely matters. For Canadian clients, workloads kept in Canadian AWS regions, and a record you can show a customer of exactly where their data sits. Fixed price, agreed after a scoping call.
AWS has two Canadian regions, Canada (Central) in Montreal and Canada West (Calgary). For Canadian clients we build in Canadian regions by default, so primary data and backup copies can both stay in the country.
Why customers ask where their data lives
Canadian customers, larger ones especially, often ask where their data is stored before they sign. For many AWS environments the honest answer is messier than it should be. The main database is in Canada, but backups are copied to a US region, logs land in a bucket somewhere else, and a third-party tool processes data in a place nobody checked.
Some clients also ask about PIPEDA or provincial privacy rules. We do not give legal advice, and whether the law requires your data to stay in Canada is a question for your counsel. What we do is build the environment so that, whatever the answer, you can show where every piece of data lives.
What a security and residency review covers
The findings are rarely dramatic. They are the basics that slipped while the team was shipping.
IAM least privilege
Policies cut back to what each person and service actually uses, based on CloudTrail activity and IAM Access Analyzer. Wildcards removed, unused roles and access keys retired.
How people sign in
Staff sign in through IAM Identity Center with short-lived credentials, instead of long-lived access keys sitting on laptops and in CI settings.
Secrets out of code
Database passwords and API keys moved out of environment variables and source control into Secrets Manager, with rotation where the service supports it.
Encryption that matters
KMS keys where they add real control, encryption by default everywhere else, and a clear answer on who can decrypt what.
Region guardrails
Service control policies in AWS Organizations that deny activity outside the regions you approve, so data cannot drift out of Canada by accident.
Audit trail and detection
CloudTrail across every account and region, logs kept where they cannot be quietly deleted, and GuardDuty findings sent to someone who will read them.
Where your data actually sits on AWS
Choosing ca-central-1 or ca-west-1 is the start, not the whole answer. A few AWS services are global rather than regional, some features reach newer regions later than others, and third-party tools can send data elsewhere. Part of the review is going through each service you use and writing down where its data is stored, so the answer you give a customer is one you can back up.
How the review runs
- Scoping call and proposal. We agree what is in scope, then send a written proposal with the deliverables, a fixed price and a delivery date.
- Read-only review. We look at IAM, secrets, encryption, logging and where each service stores data, without changing anything.
- Findings. Every finding carries a risk rating and a fix, in the order we would make them.
- Fixes. We make the changes in Terraform, or your team does from the report, which is written so they can.
What you get
- Findings ranked by risk, each with a recommended fix
- IAM permissions cut back to what is genuinely needed
- Secrets moved out of environment variables and source control
- A residency record: every service, its region, and where its data lives
- Region guardrails that stop new resources appearing outside Canada
- Ground prepared for SOC 2 or similar, if that is where you are heading
What this is not
It is not legal advice. We tell you exactly what we built and where the data sits, and your counsel decides whether that meets your obligations. It is not a compliance certification either. We can prepare the ground for SOC 2 or similar, but an auditor has to certify it.
What it is: an environment where the security basics are done properly, and the residency answer is a fact rather than a hope. If your workloads are not in Canada yet, moving them is a staged migration. If backups are part of the question, that sits with reliability and disaster recovery. And a cost audit flags the security issues it notices along the way, separately from the savings.
Who this is for
Canadian companies selling to customers who ask where their data lives. And any team on AWS whose IAM grew one urgent permission at a time until nobody could say who has access to what. We work with teams in Canada, the United States and Europe, remotely. For Canadian clients, Canadian regions are the default.
Frequently asked questions
Which AWS regions are in Canada?
Two. Canada (Central), ca-central-1, in Montreal, and Canada West (Calgary), ca-west-1. For Canadian clients we build in Canadian regions by default, and with two regions in the country, backup copies can stay in Canada too.
Does PIPEDA require our data to stay in Canada?
That is a legal question, and your counsel should answer it. Clients do ask us about PIPEDA and provincial privacy rules. What we do is build so your data stays in Canadian regions and document where it lives, so whatever the answer is, you can show it.
What does an IAM least privilege review involve?
We compare what each user, role and service is allowed to do with what it actually does, using CloudTrail activity and IAM Access Analyzer. Anything unused or too broad is cut back one change at a time, each with a way to undo it.
Can you show a customer that our data stays in Canada?
We can give you a written record of every service you use, the region it runs in and where it stores data, along with the service control policies that block other regions. That is something you can hand to a customer security team.
Will this get us SOC 2?
Not on its own. We prepare the ground, with access control, logging, encryption and documentation in place, but an auditor has to certify it.
Do you need admin access to review our account?
No. The review starts from a read-only role, so we can see configuration without changing it. Fixes come afterwards, through Terraform or by your own team, once you have agreed what to change.
Related services
Get a straight answer about your data
Fifteen minutes on a call is enough to tell whether a security or residency review is worth it for you. If it is not, we will say so.