Data handling, sovereignty and controlled goods
When you send a drawing through Made to Spec you hand over a valuable asset. This page is the reference a procurement or compliance officer needs: where your files live, who can reach them, how we verify shops, and how we handle controlled goods. For a completed supplier questionnaire or our current certifications, email compliance@madetospec.ca.
Canadian data sovereignty
Made to Spec is Canadian-owned and Canadian-operated. Your design files are stored on Canadian infrastructure, governed by Canadian law, and routed only to Canadian shops. There is no foreign corporate parent that could pull your data under another jurisdiction. The distinction between data residency (where a file sits) and data sovereignty (whose laws govern it) matters for sensitive work, and it is covered in depth in data residency vs. data sovereignty.
Controlled goods (CGP)
The Controlled Goods Program (CGP), under Canada's Defence Production Act (R.S.C. 1985, c. D-1), governs the examination, possession and transfer of controlled goods and controlled technical data, which explicitly includes blueprints and specifications with military or national-security significance.
If your part or its drawings are controlled goods, tell us before you upload. We route controlled work only to CGP-registered Canadian shops, and we surface CGP registration on a shop's record so it can be checked rather than assumed. Made to Spec's own handling of controlled technical data, including current CGP registration status and our designated official, is available to qualified buyers on request at compliance@madetospec.ca. We do not route controlled goods to shops we cannot verify as registered.
What we verify, and how
A shop's certifications are verified against the issuing registry before its record is marked verified, so a credential is confirmed rather than self-declared. Certifications that our enrichment process spots from a shop's public materials are treated as reported for review, never auto-asserted: a shop is only shown as holding a certification once it is confirmed. Certification is enforced as a hard, exact requirement during matching. An RFQ that requires a certification is never routed to a shop without it.
Your files: access and retention
A drawing you upload is used for one purpose: to match and route your RFQ to capable Canadian shops. It is not sold, published, or used to train models. Access inside Made to Spec is limited to the people running concierge matching, all accountable under Canadian law. Files are shared with a shop only when your job is routed to it, and only the files needed to quote.
We retain a drawing for as long as your RFQ is active plus a limited window for follow-up quoting, then it is purged on our standard schedule. You can ask us to delete a file sooner, or confirm deletion, at compliance@madetospec.ca. Our current retention period and deletion process are available on request.
Foreign government data requests
Because Made to Spec is a Canadian company operating on Canadian infrastructure with no foreign parent, your files are subject to Canadian legal process, not a foreign regime that could compel disclosure. We do not voluntarily disclose customer files, and we would require valid Canadian legal process before producing any. This reduces and controls exposure; it is not a promise that no lawful process can ever reach data, which no honest provider can make.
Questions a procurement or compliance team can ask us
- Our legal entity, business number and registered address.
- A completed supplier or vendor security questionnaire.
- Current certifications and CGP registration status.
- Our file-retention period and deletion process.
- Our position on foreign data requests, in writing.
Email compliance@madetospec.ca and we will return the documents your process needs. Setting us up as an approved vendor is covered on the vendor onboarding page.
This page is a summary of policy and practice, not legal advice. The Controlled Goods Program, export controls and Canadian privacy law are complex and fact-specific. For decisions about controlled goods or data-handling obligations on sensitive work, consult qualified Canadian legal counsel. Last reviewed: September 2026.