Why your client data should stay in Canada

When a Québec SMB signs a contract with a US-based AI vendor, it rarely takes time to read where its data will actually live. Yet since Law 25 came fully into force in September 2023, that question is no longer optional, it is legal.

Here is what you should know before your next contract renewal.

What Law 25 actually changed

Law 25, formerly Bill 64, modernizes Québec's private-sector privacy framework. For most SMBs, three obligations matter operationally.

First, explicit consent. Before collecting, using or disclosing personal information, you must obtain consent that is clear, free, informed, and given for a specific purpose. Implicit consent no longer suffices in most contexts.

Second, the privacy impact assessment (PIA). Before transferring personal information outside Québec, an organization must conduct a PIA that assesses whether the destination jurisdiction offers equivalent protection.

Third, the right to portability and to erasure. Your clients can request their data in a structured format and demand its deletion. If your AI vendor lacks an API to honour those requests within a reasonable delay, that becomes your problem, not theirs.

The cross-border transfer trap

The United States lacks, at the federal level, a privacy law comparable to Europe's GDPR or Québec's Law 25. The US CLOUD Act allows federal authorities to access data held by US providers, even when the data physically lives outside US territory.

That means a US-based AI vendor hosting your client data in a Toronto datacenter remains subject to the CLOUD Act. Your data can be subpoenaed without your knowledge, with no practical recourse for your client.

The PIA required by Law 25 should, strictly applied, conclude that this transfer does not meet the equivalent-protection standard. Québec's Commission d'accès à l'information has not yet pursued an SMB on this point, but European jurisprudence (the Schrems II ruling) has already reached the same conclusion under GDPR.

Why AI concentrates the risk

A traditional email tool processes your client data request by request. An AI tool typically needs to index your full history to function well. The AI hotline that answers your after-hours calls has access to your client cards. The AI CRM that suggests who to contact next queries your full conversation history.

This concentration creates three cumulative risks.

First, the exposure surface. An AI vendor typically holds more of your data than a traditional SaaS vendor, and holds it in a more structured form, therefore faster to exfiltrate.

Second, training. If your vendor uses your data to train its models, even in aggregated form, patterns from your client interactions can leak into the vendor's other clients. This has happened repeatedly with consumer-grade text generation tools.

Third, downstream dependencies. Your AI vendor probably uses its own infrastructure suppliers (AWS, Azure, GCP) and its own inference suppliers (OpenAI, Anthropic, Google). Each link in the chain is a potential transfer point. Your direct vendor's compliance does not protect you if its principal subcontractor is non-compliant.

The three questions to ask your AI vendor

Before signing or renewing, ask for written answers to these three questions.

Where does my data physically live, in transit and at rest, including backups? The answer should name a specific cloud region. "Canada" is not an acceptable answer. "ca-central-1 in AWS Montréal" is. Anything containing the words "United States", "multi-region", or "close to your users" should prompt a follow-up question.

Is my data used to train models, yours or a third party's? The right answer is no, unconditional, and the clause should be in the contract. If the answer is "only if you agree", check the default. If the answer is "in aggregated and anonymized form", ask for the anonymization method. Re-identification is easier than people think.

Which subcontractor handles my data for AI inference? If your direct vendor is Canadian but its inference engine is OpenAI hosted in the United States, the transfer happens at every request. Ask for the complete list of subcontractors processing personal information, and their jurisdiction.

Our position at Reach Central

We built Reach Central with a single non-negotiable constraint: no client data crosses the 49th parallel.

Concretely, AI inference runs in ca-central-1, AWS Montréal. The models we use are accessed through the relevant providers' Canadian regions, or self-hosted. Backups stay in Canada. Logs too.

This constraint carries a real technical cost. Some AI features available in US regions arrive three to six months later in our product because we wait for regional availability or do the porting work. We accept this because the sovereignty promise does not tolerate "temporary" exceptions.

A checklist for your SMB

If you already use one or more AI tools, here is what you can do in the next two weeks.

First, take inventory. List every active AI tool, its vendor, and what client data it processes. Include the tools your employees use without formal approval, they are usually more numerous than you think.

Second, ask each vendor for written answers to the three questions above. Give them two weeks. Silence or evasive answers are signals.

Third, run a brief PIA on every tool that processes personal information. If you do not have a designated privacy officer (mandatory in Québec for private organizations since 2022), this is the moment to appoint one.

Fourth, plan a migration budget. If one of your tools fails the test, anticipate three to six months to migrate cleanly to a compliant solution. A rushed migration under regulatory pressure costs three times what a planned one costs.

Law 25 is not going away. AI tools will continue to proliferate. The SMBs that do the work now save the legal fees later.