Canadian hosting = automatic Law 25 compliance?

Necessary but not sufficient. Law 25 compliance also depends on board practices (policy, PIA, incident register, training). A Canadian tool makes compliance simple; a US tool makes it complex. Kohabit provides the technical part: where the data lives, under which law, and how to get it back.

If I'm on AWS Canada, am I sovereign?

No. AWS is an Amazon (USA) subsidiary, hence subject to the CLOUD Act. AWS Canada localizes storage, not legal sovereignty. Common trap. Kohabit relies on infrastructure providers whose operating entity is Canadian.

What about OVH or Hetzner?

What matters is not the group's nationality but two things: where the data physically resides, and which jurisdiction can compel access to it. OVH and Hetzner are European groups, subject to the GDPR and beyond the reach of the American CLOUD Act. Hosted in a Quebec data centre through their Canadian entity, your data stays in Canada: that is not a transfer outside Canada. Hosted in Roubaix or Frankfurt, it is, and Law 25 then calls for a privacy impact assessment. The first case is the one that applies to Kohabit: our servers are in Beauharnois, Quebec, with OVH Hosting Inc., the Canadian entity of the OVHcloud group.

What if Kohabit shuts down or gets acquired by a US company?

The honest answer is that no clause fully protects you from a change of shareholder. What protects you in practice is being able to leave: your data belongs to you, it exports as an archive you request whenever you want, and nothing binds you beyond your current subscription period. A tool you can walk away from with your data is a tool whose acquisition commits you less.

How do I verify Kohabit really keeps its commitments?

Do not take our word for it, check. Our privacy policy documents where your data lives. Your data is returned on request in an exportable format, which makes an audit possible. The location of the servers is technically verifiable: our IP addresses resolve to Beauharnois, Quebec. And the Quebec CAI can be contacted in case of doubt.

Can the CLOUD Act reach a six-unit condo board?

In principle, yes. The CLOUD Act makes no distinction by size: it targets data held by an American company. Nobody in Washington cares about your building in particular, but your data no longer answers to Canadian law alone, and a breach at the provider hits you just as it hits its large clients.

Is there a CLOUD Act agreement between Canada and the United States?

The CLOUD Act provides for bilateral agreements that frame requests from one country to the other. No such agreement was in force between Canada and the United States in May 2026. For data held by an American company operating in Canada, the law therefore applies with no diplomatic safeguard.

Do notification emails leave Canada?

Yes, and the question is rarely asked. A notification email often carries an excerpt: an announcement title, the description of a maintenance request. Kohabit's go out through Mailgun, owned by the Swedish group Sinch, in its American sending region: those excerpts are therefore processed in the United States. Mailgun offers a European region, separate from the American one, and Kohabit plans to move there. It is the question to ask any provider, Kohabit included.

What are the alternatives to the common American tools?

For email: Proton Mail (Switzerland) or Tuta (Germany). For files: Sync.com (Canada) or pCloud (Switzerland). For electronic signatures: DocuSign offers Canadian data residency if you ask for it, and Signéo is from Quebec. For video calls: self-hosted Jitsi, or Whereby (Norway).

Does Kohabit use trackers or American services?

No third-party tracker: no Google Analytics, no Facebook pixel, no Hotjar. Visit statistics come from Umami, hosted in Canada, with no cookie. Three American services, or services in an American region, are named on this page: Cloudflare for the site's traffic, Mailgun for notification emails, and OneDrive if the board turns it on.

Hosted and operated in Canada

Your condo data stays in Canada

A Quebec condo board should not have to wonder if a Texas judge can read its minutes. With Kohabit, everything is hosted and operated in Canada, and the US CLOUD Act does not apply to what is stored there.

A practical guide, for information only. It does not replace legal advice.

Create my account

No credit card. Hosted in Beauharnois, Québec.

What is digital sovereignty?

Digital sovereignty is an organization's ability to keep control of its data: where it lives, who can access it, under which laws it is protected. For a Quebec condo board, this means, in practice, that data (co-owner list, financial statements, votes, minutes) stays subject to Canadian and Quebec law, and to it only.

Law 25 requires a comparative analysis of the legal regime of any foreign vendor hosting personal data. In short: using a US tool to run your condo costs you regulatory work you'd skip with a Canadian tool.

The CLOUD Act explained simply

The CLOUD Act (Clarifying Lawful Overseas Use of Data Act) is a US law passed in March 2018. It allows US authorities to compel access to data held by a US company, no matter where that data is physically stored in the world.

Concrete consequence: if you use a US software (Buildium, Yardi, DoorLoop, AppFolio, etc.), even if the vendor "hosts your data in Canada", it remains legally reachable by US judicial subpoena, without you being notified.

US tool

Data reachable by US authorities, regardless of storage country. No Quebec remedy.

Canadian tool (Kohabit)

Data stored in Québec, under Canadian and Quebec law. Recourse with the Quebec CAI available.

Why a condo board is directly concerned

People often think digital sovereignty is a topic for banks or ministries. A condo board nonetheless collects the categories Law 25 treats as the most sensitive:

Personal data

Name, address, email, phone, date of birth, emergency contacts, household composition.

Financial data

Account balances, schedules, arrears, share, sometimes banking details.

Legal data

Named votes, complaints, noise reports, ongoing legal matters.

Property data

Each co-owner's share, relative unit values, upcoming projects.

A leak or unauthorized look at a single one of these categories gets paid for at the general meeting, and trust does not come back quickly.

The likeliest case is not an American warrant, it is a breach at the provider. If the incident presents a risk of serious injury, the syndicate must notify the Commission d'accès à l'information and the people concerned (s. 3.5 of the Act respecting the protection of personal information in the private sector). When the provider takes weeks to say what got out, the board is the one left without answers in front of its co-owners.

How Kohabit guarantees sovereignty

Your data is stored in Beauharnois, Québec, with OVH Hosting Inc. One exception, which you turn on yourself: the OneDrive integration, which copies your documents to Microsoft. It is off by default. The site's traffic goes through Cloudflare, an American company, which protects it from attacks, and notification emails go out through a sending provider.

Beauharnois, Québec

Your data is stored with OVH Hosting Inc., the Canadian entity of the OVHcloud group.

Canadian operator

Kohabit is a Canadian company, based in Montreal.

Encrypted in transit and at rest

TLS 1.3 in transit, encryption at rest, encrypted backups.

Log of administration actions

Exports, closing the co-ownership, deletion requests and Drive connections are logged.

Your data leaves with you

The archive holds the register as JSON, the accounting and maintenance log as CSV, and your documents as they are.

One exception to know about: the optional Drive integration

Kohabit optionally lets you sync your documents with an external Drive (Microsoft OneDrive or SharePoint). If the manager turns this on, copies of your documents are then stored with Microsoft, a US provider: those copies are no longer hosted in Canada and fall under the CLOUD Act. It is an explicit choice, off by default. As long as no Drive is connected, your data stays in Canada. Learn about the Drive integration

Data in Canada or in the United States: the comparison

Point by point, how Kohabit compares with the US tools most used for condo management (Buildium, Yardi Breeze, DoorLoop, AppFolio).

Criterion	Kohabit	US tools
Entity operating the service	Canadian (Montreal)	American
Law that applies to the data	Canadian and Quebec law	US law (CLOUD Act) and local law
Where it is stored	Beauharnois, Québec, with OVH Hosting Inc.	Depends on the vendor and the plan
Reach of the CLOUD Act	Does not apply to what is stored with a Canadian host	Applies to US companies and their subsidiaries
What leaves Quebec	Notification emails (see the FAQ), and OneDrive if you turn it on	The app's data
Data export	At any time, as CSV, PDF and JSON	Depends on the contract
Recourse in a dispute	Canadian courts	Often an American jurisdiction
Third-party trackers	None (Umami, hosted in Canada)	Varies, often Google Analytics
Billing currency	CAD	USD (FX risk)

See the full Kohabit vs Buildium comparison

Assessing your current provider

Before signing or renewing, ask these six questions in writing. A vague answer is already an answer.

Where are the servers that store our data?

"North America" is not enough: ask for the city and the data centre.
Who legally operates those servers?

A Canadian subsidiary is not enough if the parent company is American.
Are you subject to the CLOUD Act?

For American software, the honest answer is almost always yes, Canadian subsidiary or not.
What do you do if a foreign government asks for our data?

Look for a written commitment in the contract, not a promise to do your best.
How do you comply with Law 25?

Ask for the technical detail: where the data goes, who can reach it, what leaves Quebec.
How do we get our data back when we leave?

The format, the timeline and the price: a paid export is an exit cost.

What switching tools costs

For a small condo, switching tools mostly takes time: exporting the data from the old one, entering it in the new one, checking, telling the co-owners. In Kohabit, documents import from OneDrive; co-owners, balances and history are entered by hand.

Kohabit costs $2.99 per door per month, everything included, so $29.90 a month for a ten-unit building. The trial lasts 60 days, with no card.

Staying has a cost too. As long as the data sits with an American provider, it stays within reach of the CLOUD Act. And before communicating personal information outside Quebec, Law 25 calls for a privacy impact assessment (s. 17 of the Act respecting the protection of personal information in the private sector).

Canadian and Quebec legal framework

For deeper context, here are the main legal texts applicable to a Quebec board when it comes to data.

Law 25 (Quebec, adopted in 2021)

Modernizes Quebec personal data protection. Aligns the framework with European GDPR.

Our Law 25 guide →

PIPEDA (Canada, 2000)

Federal Personal Information Protection and Electronic Documents Act. Applies to Canadian companies in addition to provincial frameworks.

Civil Code of Québec

Articles on privacy protection and image rights. Applies to photographs in condo communications notably.

Bill 96 (Charter of the French Language, 2022)

Strengthens French usage in Quebec, including digital tools used by organizations.

Frequently asked questions

Stored in Beauharnois.

Exportable whenever you want, as CSV, PDF or JSON.