Why Host Your Data in Canada? Sovereignty, Privacy, and Legal Obligations

Most condominium management tools rely on servers located in the United States. For volunteer condo boards in Quebec, this choice has a direct impact on your co-owners' data privacy, compliance with Law 25, and protection against foreign legislation like the American CLOUD Act.

The problem: where does your condo data go?

A condominium accumulates sensitive data: co-owner names and addresses, unit numbers, banking information, meeting minutes, invoices, insurance documents, incident history.

Most popular management tools (Google Workspace, Dropbox, Microsoft 365, American accounting software) are developed by American companies and store your data on American servers. Even if data is physically stored in Canada, if the company is American, your data remains subject to American law.

What is the CLOUD Act and why does it affect you?

The CLOUD Act (Clarifying Lawful Overseas Use of Data Act), passed in the United States in 2018, allows US authorities to access data held by American companies, regardless of where that data is physically stored in the world.

In practice:

• Google Workspace is subject to the CLOUD Act. Your emails, documents, and files shared via Google Drive can be accessed by US authorities.
• Microsoft 365 is subject to the CLOUD Act. Your OneDrive files and Teams conversations can be demanded.
• Dropbox is subject to the CLOUD Act, even if your files are stored in a Canadian data center.

For a volunteer condo board, this means the personal data of your co-owners, your finances, and your private communications could technically be accessed by third parties without your consent or knowledge.

Kohabit is not subject to the CLOUD Act. Kohabit is a Canadian company that hosts your data on Canadian servers, under Canadian jurisdiction exclusively.

Law 25 in Quebec and your privacy obligations

Law 25 (formerly Law 64) is Quebec's personal information protection law. Since 2022-2024, its requirements have been strengthened for all organizations, including condo syndicates:

• Designate a person responsible for personal information protection
• Document and report any privacy incident to the Commission d'accès à l'information
• Obtain informed consent for data collection and use
• Only use providers offering adequate data protection guarantees

That last point matters: if you use an American tool to manage your condo data, you will need to document and justify that choice under Law 25 requirements. With Kohabit, compliance is built in from the start.

What "hosted in Canada" means concretely for Kohabit

When Kohabit says your data is hosted in Canada, it means:

• Servers are located in Canada.
• No American subcontractor is used for data storage.
• Data never leaves Canadian territory.
• Kohabit is governed exclusively by Canadian law (federal PIPEDA and Quebec Law 25).

Comparison: hosting data in Canada vs. the United States

| Criterion | Canadian hosting (Kohabit) | American hosting |

|-----------|---------------------------|-----------------|

| Applicable law | Canadian law (PIPEDA, Law 25) | American law (CLOUD Act) |

| Access by foreign authorities | No | Possible without your consent |

| Law 25 compliance | Built in | Must be documented and justified |

| Jurisdiction in disputes | Canada | United States |

| Control over your data | Total | Limited |

Frequently asked questions

Is my data really in Canada? Where exactly?

Yes. Kohabit's servers are located in Canadian data centers. Your data never leaves Canadian territory and is never transferred to American subcontractors.

Who can access my data?

Only you and the board members you have authorized. The Kohabit team can access data for technical support purposes, with your consent. No third party can access it without your authorization.

What happens if I cancel my account?

Your data belongs to you. Upon request, Kohabit will return it to you in an exportable format. Data is then deleted from our servers within a reasonable timeframe.

Sources:

CLOUD Act (2018): https://www.congress.gov/bill/115th-congress/senate-bill/2383

Law 25 Quebec: https://www.legisquebec.gouv.qc.ca/en/document/lc/P-39.1

PIPEDA: https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/