Data residency has become a marketing line, which makes it easy to stop asking questions once you hear it. For regulated organizations, the phrase is only worth what the contract says it is.
Four questions worth asking
Which specific region does the primary workload run in? “Canada” is not a region; Canada Central and Canada East are. A vendor who cannot name one is describing an intention, not an architecture.
Where do backups and disaster recovery copies replicate to? Primary storage frequently sits in Canada while the secondary copy quietly lands elsewhere. Ask for both.
Keys and access
Who holds the encryption keys, and can staff outside Canada access the data for support purposes? A Canadian-hosted service administered by a support team elsewhere may still create a disclosure obligation you need to understand.
This is not hypothetical for healthcare, municipal, and education clients, where the question comes up in procurement and has to be answered in writing.
Get it in the agreement
If residency matters to your organization, it belongs in the contract alongside uptime and support response, not in a logo on a website. A vendor who means it will put it there without much argument.
