Data residency vs. data sovereignty: where does your drawing actually live?

A sourcing guide for Canadian manufacturers, engineers and procurement teams weighing where to send their design files.

When you upload a CAD file to get a part made, you're handing over one of your most valuable assets: the design itself. For a bracket on a consumer gadget, that may not keep you up at night. For a component headed into an aerospace program, a medical device, or anything touching defence, it should, because where that file goes, and whose laws govern it once it's there, is not the same question as it first appears.

Two terms get used interchangeably and shouldn't be: data residency and data sovereignty. Getting the difference right changes how you choose a manufacturing partner.

The distinction in one line

Data residency is where your data physically sits. Data sovereignty is whose laws govern it. A file can reside on a server in Toronto and still be subject to a foreign government's legal reach. Residency is about geography; sovereignty is about jurisdiction and control, and control is the one that actually protects you.

The Government of Canada's own guidance draws exactly this line: data residency is the physical or geographical location of digital information, while data sovereignty is Canada's right to control access to and disclosure of information subject only to Canadian laws.

Why "servers in Canada" isn't the whole story

Many platforms advertise "Canadian data residency", your data configured to sit on Canadian servers. That's real, and it's not nothing. But if the company holding that data is incorporated in the United States, the physical location doesn't fully insulate the file.

The reason is the U.S. CLOUD Act (the Clarifying Lawful Overseas Use of Data Act, passed in 2018). It gives U.S. authorities a mechanism to compel U.S.-incorporated companies to produce data within their possession, custody, or control, regardless of where that data is physically stored. So a U.S.-parented provider storing your drawing on a Canadian server is still, in principle, reachable through U.S. legal process. This is well documented by Canadian law firms and acknowledged in the Government of Canada's white paper on data sovereignty.

Put simply: residency addresses where your file sits; it does not settle whose courts can reach it.

The honest limits: what the CLOUD Act is not

Overstatement on this topic is common and it erodes trust with exactly the sophisticated buyers who care.

The CLOUD Act is not blanket surveillance, and it does not grant unfettered access to anything stored in the cloud. Requests operate under tiered legal standards, and stored content like design files generally requires a warrant based on probable cause, not a simple administrative demand. Companies can and sometimes do challenge requests.

Reputable Canadian legal analysis also points out there are no widely documented cases of a foreign government compelling access to a Canadian enterprise's ordinary business data held in cloud services. The risk is real and structural, but it is a risk to manage thoughtfully, not a five-alarm fire for every part you make. For a run of aluminum brackets with no sensitivity it may not matter at all. For controlled or defence-adjacent work it can be decisive.

What actually delivers sovereignty

Sovereignty comes from control, across a few dimensions:

• Jurisdictional control: the company handling your file is subject to Canadian law, not a foreign legal regime that can compel disclosure. In practice, a Canadian-incorporated, Canadian-operated provider without a U.S. corporate parent.
• Operational control: the people who can access the system are accountable under Canadian law, with no foreign parent able to override them.
• Storage and access: Canadian infrastructure, reachable only in Canada.

A useful warning: a company incorporated in Canada but owned by a U.S. parent can be pulled back under U.S. jurisdiction through that parent. So a Canadian-sounding brand isn't the test, the ownership and operational chain is.

Why this matters more for some parts than others

Defence and controlled goods. In Canada, anyone who examines, possesses, or transfers controlled goods or technology must be registered in the Controlled Goods Program (CGP), the law under the Defence Production Act. Controlled goods explicitly include technical data such as blueprints and specifications with military or national-security significance. Registration effectively requires being a business authorized to operate in Canada with a Canadian-citizen-or-permanent-resident designated official. A U.S.-owned instant-quote marketplace routing your file to an anonymous global network is not a CGP-registered Canadian producer. Non-compliance carries serious penalties, fines up to $2 million and imprisonment up to 10 years.

Aerospace, medical and IP-sensitive work. Even outside formal controlled-goods rules, proprietary designs, tolerances and process know-how are the intangible edge that separates a company from its competitors. The fewer copies of that file on infrastructure you don't control, the smaller your exposure.

Everything else. For non-sensitive commodity parts, convenience and price may reasonably win. The point isn't that every file needs maximum protection, it's that you should choose the level deliberately.

Questions to ask any manufacturing platform

1. Who legally owns the company handling my file, and is there a foreign parent anywhere in the chain?
2. Where is my file stored, and who can access it?
3. Do I know which shop will actually make my part, or does the platform route it to an undisclosed network?
4. If the work is controlled, is the producer CGP-registered, and can I verify that?
5. What's the provider's policy on foreign government data requests?

The transparency of the answer is itself a signal. A platform that keeps the shop anonymous can't answer questions 3 and 4 at all.

Where Made to Spec sits

Made to Spec is a Canadian-owned directory. When you send a drawing through it, the file stays on Canadian infrastructure and is routed only to Canadian shops you can see, vet and choose, with certifications, including CGP registration where applicable, surfaced on each shop's profile. Your design files are governed by Canadian law, and you always know exactly who is making your part. No anonymous routing, no offshore detour, no foreign-parent exposure.

That's not a promise of an impenetrable shield, no honest provider can offer one, and sovereignty is about reducing and controlling exposure, not eliminating every theoretical risk. It's a straightforward structural difference: a Canadian company, Canadian infrastructure, named Canadian shops, under Canadian law.

This guide is general information, not legal advice. The Controlled Goods Program, the CLOUD Act and Canadian privacy law are complex and fact-specific. For decisions about controlled goods, export controls, or data-handling obligations for sensitive work, consult qualified Canadian legal counsel.

Last reviewed: July 2026. Related reading: AS9100 vs ISO 9001 and reshoring to Canada.