Your data, and the law that can reach it.
The question is not only where your data is stored. It is who can be compelled to hand it over, and under which jurisdiction. Here is ours, in plain terms.
The CLOUD Act follows the provider, not the server.
This is the point most procurement questionnaires miss. The US CLOUD Act allows a provider subject to United States law to be compelled to produce data it holds or controls, wherever that data is hosted. A data centre in Frankfurt or Montreal changes nothing if the company, its parent or its subsidiary falls under that jurisdiction. Server location answers the wrong question; the right one is about the provider's nationality.
Three facts you can check
Canadian company, Canadian hosting
FortaRisks is a Canadian company, and your application data is hosted in Canada by default, with a Canadian operator. No US entity sits in the processing chain, so the CLOUD Act has no hold.
European adequacy
Canada benefits from a European Commission adequacy decision covering private organisations subject to PIPEDA. A transfer of personal data from the EU to FortaRisks therefore rests on that basis, with no standard contractual clauses to negotiate and no transfer impact assessment to build.
EU or US hosting if you require it
Canada is the default, not a constraint. Hosting in the European Union or the United States is available at onboarding when your organisation, your regulator or your customer requires it.
What it changes, depending on where you sit
Canadian organisation
Your personal information stays in Canada, which Law 25 and PIPEDA ask you to document. You have no transfer outside Quebec to justify and no foreign authority access risk to assess.
European organisation
The transfer rests on adequacy rather than on a contractual construct. And NIS2 and DORA are among the 31 frameworks you assess and prove inside the platform, with free readiness checks to size your gap.
Defence supplier
The Canadian Program for Cyber Security Certification gates access to contracts. We prepare the attestation, including the 13 ITSP.10.171 requirements at Level 1.
The questions your legal team asks
Where is my data by default?
In Canada, with a Canadian operator. That covers application data and this site alike: origin servers, images and analytics. Cloudflare acts only as a CDN and security proxy, with Canadian data localization enabled.
Can the CLOUD Act reach you?
It applies to providers subject to United States law. FortaRisks is a Canadian company, with no US entity in the chain that processes your data.
What exactly does European adequacy cover?
The European Commission decision covers Canadian private organisations subject to PIPEDA, for personal data received from the Union in a commercial context. We make the detail of our scope available to your legal team.
Can I require hosting in the European Union?
Yes, at onboarding. Tell us which constraint you have to satisfy, regulatory or contractual, and we scope the hosting region accordingly.
Do you use my content to train models?
Never for models served to other customers. AI enrichment is optional module by module, and where inference runs is decided with you.
A jurisdiction question to settle?
Our team answers legal and security questionnaires, and provides the detailed dossier under NDA.
Talk to our team