Policies
Map.ca policy

Data Residency Policy

Defines where Map.ca stores and processes data. Canadian-first residency wherever practical; disclosure when trusted vendors process data outside Canada.

Map.ca’s default is Canadian-first data residency wherever practical, with clear disclosure when trusted vendors process data outside Canada. The Data Residency Policy defines which categories of data must stay in Canada, which can be processed elsewhere under disclosure, and how that disclosure is surfaced to users.

It applies to engineering, procurement, and any staff member who selects a vendor. The AI Vendor Policy and Vendor Security Policy carry through specific residency requirements for AI and security vendors.

Requirements

  • Default sensitive data to Canadian residency.
  • Disclose vendor residency publicly when data is processed outside Canada.
  • Apply stricter residency rules to civic and Indigenous data.

Prohibitions

  • Do not move sensitive data outside Canada without disclosure.
  • Do not engage a vendor whose residency cannot be verified.

Related policies

AI Vendor PolicyStandards that AI vendors must meet to handle Map.ca traffic — data handling, training restrictions, audit requirements.Vendor Security PolicySecurity requirements Map.ca holds vendors to before, during, and after engagement.Privacy PolicyWhat Map.ca collects, why, how long it is kept, who it is shared with, and what rights people have.Indigenous Data Sovereignty PolicyHow Map.ca handles Indigenous community data, cultural places, traditional knowledge, names, language, heritage, and map layers.