“Where is our data stored?” is now one of the first questions Canadian organizations ask a maintenance software vendor. It comes up in procurement for municipalities, school boards, health authorities and universities, and more and more in private companies too. A CMMS (computerized maintenance management system) holds more than asset lists: it holds people’s names and contact details, building layouts and security information. This guide explains what that data is, what Canadian privacy laws say about storing it, why “hosted in Canada” is only part of the answer, and the questions to ask any vendor before you sign.
What a CMMS actually stores
It is easy to think of maintenance data as purely technical. In practice, a typical CMMS holds:
- Personal information: the names, emails and phone numbers of everyone who submits a request, and the technicians, contractors and approvers who handle it.
- Work and time records: who worked on what, when and for how long, which can amount to employee performance data.
- Building and security details: floor plans, room uses, access notes, alarm and key information, and the location of critical equipment.
- Contractor and compliance documents: insurance certificates, WCB clearances, licences and contracts.
- Photos and attachments: which can show people, vehicles or the inside of restricted areas.
That mix is why privacy officers, IT security teams and procurement all want to know where it lives and who can reach it.
What Canadian privacy laws say
There is no single national rule that all data must stay in Canada. The answer depends on who you are and where you operate. The table below is a summary, not legal advice, so check the current rules with your privacy officer or legal counsel.
| Who | Law | What it means for storage outside Canada |
|---|---|---|
| Private businesses across Canada | LPRPDE | Transfers are not banned, but you stay accountable for the data, must use contracts to give it comparable protection, and should tell people it may be processed abroad and reached by foreign authorities (OPC guidelines). |
| Organizations collecting data in Quebec | Law 25 (Private Sector Act) | Since September 22, 2023, a privacy impact assessment and a written agreement are needed before personal information leaves Quebec, even to another province (summary). |
| B.C. public bodies | FOIPPA | The strict data-residency rule was removed on November 25, 2021, but privacy impact assessments still apply, including when the storage location changes (summary). |
| Nova Scotia public bodies, municipalities and their service providers | PIIDPA | Personal information should be stored and accessed only in Canada, unless the head of the body approves an exception and reports it (FAQ). |
| Alberta public bodies | Protection of Privacy Act | Replaced FOIP on June 11, 2025, with new requirements for privacy impact assessments and privacy management programs (Alberta.ca). |
Even where the law allows storage abroad, many public bodies make Canadian hosting a requirement in their own procurement policies, because it removes a whole category of risk and paperwork.
“Hosted in Canada” is only part of the answer
A vendor can truthfully say its servers are in Canada and still move your data elsewhere. When you evaluate a CMMS, look at the whole path your data takes:
- Backups and disaster recovery. Are backups and the failover copy also in Canada? Some cloud setups replicate to another country by default.
- Support access. Can support staff or developers outside Canada log in and see your data? Remote access can count as disclosure under some rules.
- Sub-processors. Email delivery, file storage, analytics, error tracking, AI features and SMS often run on separate services, each with its own location.
- Foreign laws. If the vendor or its cloud provider is owned by a foreign company, laws in that country, such as the United States’ CLOUD Act, may allow authorities there to demand data the company controls, even when it is stored in Canada.
- Exports and integrations. Reports emailed to personal inboxes or synced into other systems can leave your controlled environment.
Ten questions to ask your CMMS vendor
- In which country and region is our data stored, including the database, files and attachments?
- Where are backups and the disaster recovery copy kept?
- Which sub-processors handle our data, and where is each one located?
- Can anyone outside Canada access our data, and under what controls?
- Is our data encrypted in transit and at rest?
- Who owns the company and the cloud provider, and which foreign laws could apply?
- Will you sign a data processing agreement and support our privacy impact assessment?
- How quickly will you tell us about a security incident affecting our data?
- Can we export all our data in a standard format, and what happens to it when we leave?
- Is the system available in English and French, for staff and for requesters?
Ask for the answers in writing. A good vendor will have them ready, and the answers make your privacy impact assessment much faster.
Data residency and the rest of your CMMS decision
Hosting is one part of choosing maintenance software, but it should not be the only one. The system still has to make work orders, preventive maintenance and asset records easier for your team. If you are comparing systems, our guides on how to choose work order software et switching CMMS software in Canada cover the rest of the checklist, and why Canadian organizations hesitate to adopt a CMMS looks at the most common concerns.
How Zenith handles your data
Zenith is built by Zenith Software Corp., a Canadian company based in Victoria, B.C., for Canadian organizations:
- Hosted in Canada on Microsoft Azure, and your data stays in Canada. Microsoft’s Canadian Azure regions are in Toronto and Quebec City.
- One system for maintenance and space, so fewer separate tools handle your data.
- Role-based access, so people see only the sites and information they need, for example one campus and nothing else.
- A full audit trail of who did the work, who closed it and when, on every work order.
- Français et anglais throughout the app, for staff and requesters.
- Straight answers for your review. We are happy to answer your privacy and security questions in writing for your privacy impact assessment.
To see how Zenith works day to day, watch our video series, or book a 30-minute demo and bring your privacy and IT questions.
Les questions qu’on nous pose
Does Canadian law require a CMMS to be hosted in Canada?
Not always. Private businesses under PIPEDA can store data abroad if they stay accountable and protect it by contract. Some public sector rules, such as Nova Scotia’s PIIDPA, require Canadian storage, and many public bodies require it through their own policies.
Is maintenance data really personal information?
Often, yes. Requester names and emails, technician time records and photos are personal information, and building plans and security details are sensitive even when they are not personal.
What is a privacy impact assessment?
A structured review of what personal information a system collects, where it goes, the risks and how they are handled. Many public bodies, and organizations in Quebec, must complete one before adopting or moving a system.
If a vendor uses Microsoft Azure or Amazon Web Services in Canada, is that enough?
It is a strong start. Also check backups, support access and sub-processors, and ask how the vendor responds to foreign legal demands.
Par où commencer
Before you look at features, write down your organization’s rules: whether data must stay in Canada, whether you need a privacy impact assessment, and which languages you must support. Send the ten questions above to every vendor on your shortlist, and compare the written answers side by side. If you would like Zenith’s answers, contact us and we will go through them with you.