Where Your Automation Data Actually Lives in Canada
Search “data residency automation” in English and you get the same three facts, over and over, all pointed at the same reader: Zapier keeps your data in the US, Make lets you choose the EU, n8n Cloud sits in Frankfurt. Every one of those comparisons is written for someone under GDPR. If you run a business in Sherbrooke or Saskatoon, those facts are still true, but the question they answer is not your question. Canadian privacy law does not care whether your webhook crossed an ocean. It cares whether it crossed a specific line, and that line is not where most operators think it is.
This piece answers the question the European comparisons skip: where your automation data actually sits once it leaves your building, what Canadian law says about that, and the one Quebec detail that catches almost every operator off guard.
What data residency means once a webhook leaves your building
“Data residency” sounds like a technical detail, the kind of thing a vendor’s security page handles for you. It is actually a legal question wearing a technical costume.
Every time a form submission, a CRM update, or a customer record triggers an automation, that record gets copied to at least one server that is not on your premises. Where that server sits determines which country’s courts, law enforcement, and disclosure rules can reach it. A US server means a US subpoena can reach it. An EU server means GDPR governs it. The physical location is not a preference. It is jurisdiction.
Most SMB owners never ask the question, because the platforms make it invisible. You connect your CRM to your invoicing tool, watch the automation run, and never see a server. The convenience is real. So is the fact that your customers’ names, emails, and purchase history just moved somewhere, and somewhere is a legal fact with consequences, not a shrug.
This matters more once AI enters the workflow. An automation that used to just move a row of data now often reads it, summarizes it, or drafts a reply from it, which means the data doesn’t just sit on a foreign server, it gets processed by a foreign AI provider too, often a different company than the automation platform itself. Each hop is a separate question about where the information went and who can see it there.
Picture a typical five-step workflow: a contact form on your website triggers Zapier, which pushes the submission to your CRM, which fires a webhook to an AI model that drafts a follow-up email, which lands back in your inbox tool for a human to approve. That is four separate companies, and potentially four separate countries, before a single customer sees a reply. Nobody signed off on that chain explicitly. It assembled itself, one integration at a time, the way most SMB stacks do.
Zapier, Make, n8n Cloud, n8n self-hosted: where each one stores what
The three platforms that dominate SMB automation give you three different answers, and only one gives you a real choice.
| Platform | Where your data lives | Can you choose? |
|---|---|---|
| Zapier | AWS US-East-1, United States | No. Zapier states plainly that customer data is hosted in the US; there is no region-selection option on any plan. |
| Make | AWS, either Dublin/Frankfurt (EU) or Virginia (US) | Yes, once. Make lets you pick the data center region at signup, but the choice is permanent for that organization. Switching means building a new account. |
| n8n Cloud | Microsoft Azure, Frankfurt, Germany | No. Every hosted account runs in the EU by design, with no Canadian or North American region offered. |
| n8n self-hosted | Wherever you deploy it | Yes, entirely. n8n is open-source software you run yourself, so the server, the country, and the province are your decision, not a vendor’s. |
Notice what is missing from that table: a Canada option on any managed platform. Not one of the three big no-code tools lets you pin your data to a Canadian region. If keeping automation data inside Canada is a requirement for your business, self-hosting is currently the only route that gets you there without building custom infrastructure on top of a managed platform’s API.
That is not an argument against Zapier or Make. Plenty of businesses have no legal reason to require Canadian residency, and DIY convenience is worth something. It is an argument for knowing which one you are actually choosing, before a compliance question forces you to find out mid-project.
The choice also isn’t purely legal. Self-hosting n8n hands you the residency answer, but it hands you the operations question too: patching, backups, uptime, and who on your team gets paged when the server goes down at 2 a.m. A managed platform absorbs that cost for you, in exchange for putting your data on its terms, not yours. Neither trade is automatically wrong. The mistake is not knowing you made one.
Why Canada is not one jurisdiction for this question
Here is the part the American and European comparisons never mention, because it does not apply to them: Canada is not one privacy regime. It is at least two, and they ask different questions.
The federal law, PIPEDA, governs most commercial transfers of personal information across provincial or national borders. Per the Office of the Privacy Commissioner of Canada, businesses subject to PIPEDA don’t need pre-clearance to move personal information to another province or country. Instead, PIPEDA’s accountability principle makes the transferring business responsible for the information wherever it lands, generally through a contract that requires “a comparable level of protection.” No formal pre-transfer filing. No assessment document required before you flip the switch. You stay accountable, and you document that through your supplier agreements.
Quebec runs a stricter regime on top of that federal floor, and it does not wait for the data to leave Canada.
If your business is a “federal work, undertaking or business” or operates in a province without its own substantially similar private-sector law, PIPEDA is the whole story. Three provinces opted out of that default by passing their own private-sector laws instead: Quebec, British Columbia, and Alberta. A business operating only inside BC or Alberta answers to that province’s own regulator for its own customers, not PIPEDA, though PIPEDA still governs the moment data crosses a border those provincial laws don’t reach.
Quebec’s version is the strictest of the three, and it does not wait for the data to leave Canada. If you carry on business in Quebec, its Act respecting the protection of personal information in the private sector applies to the personal information of Quebec residents, and it imposes a specific, mandatory step before certain transfers happen. That step is the one nobody assumes exists, because nothing in the American or European commentary prepares you for it.
The Quebec threshold that surprises most Canadian operators
Section 17 of Quebec’s private-sector law says a business must complete a privacy impact assessment before communicating personal information “à l’extérieur du Québec,” outside Quebec, or entrusting someone outside Quebec to hold, use, or communicate it. Read that line again: outside Quebec. The statute does not say outside Canada.
Most Canadian operators build their compliance mental model around “keep it in Canada” and stop there. Section 17 does not stop there. A Quebec business sending customer data to a supplier in Toronto triggers the same obligation as sending it to Virginia. A Montreal law firm’s CRM hosted on a Vancouver server is, for this purpose, in the same position as one hosted in California. The assessment has to weigh the sensitivity of the information, the purpose of the transfer, the contractual protections in place, and the legal regime of wherever the data is going, whether that regime is Ontario’s, British Columbia’s, or a foreign country’s. Only after that assessment concludes the information will get adequate protection can the transfer proceed, and it still needs a written agreement reflecting the assessment’s conclusions.
This is not a theoretical reading of an old statute. It has been the operative rule since September 22, 2023, when this provision of Law 25 took effect, and the fines for skipping it run from $5,000 to $50,000 per violation, doubling on repeat.
Picture the ordinary version of this, not an edge case. A Quebec accounting firm signs up for a US-based invoicing platform and a Toronto-hosted payroll processor, both perfectly reasonable choices on their own. Client names, SINs, and salary data now flow to two jurisdictions outside Quebec, neither assessed, neither documented in writing. If the CAI ever asks for the file during an inspection, “the data is somewhere in Canada” is not an answer Section 17 accepts for the Toronto processor, and it was never going to be one for the US platform either.
We build with n8n, Make, and Zapier for clients across Canada, and we choose per project, not by habit. But our own tools reflect the same reasoning we apply to clients: our CRM and our e-signature platform run on infrastructure we control in Canada, not a vendor’s US region, because “your data stays in Canada” is a claim we make about our own business, not just our clients’. Self-hosting traded away a vendor’s managed uptime guarantee for a backup schedule and a patch cycle we now own ourselves, and that trade took longer to get right than the sales page for any SaaS tool would suggest.
The uncomfortable version of this section, stated plainly: a Quebec business that automated its CRM through a Toronto-hosted tool three years ago and never ran a PIA is not compliant because the data stayed in Canada. It is not compliant, period, and the fix is not a new vendor, it is the assessment that should have happened before the first sync ran.
A five-minute audit of your own stack
You do not need a consultant to find out where you stand today. You need five minutes and a list of your tools.
- List every automation platform touching personal information. CRM syncs, form-to-email connectors, invoice generators, AI drafting tools, anything moving a customer’s name, email, or transaction data.
- Look up each tool’s hosting region. Check the security or privacy page for each vendor. If it isn’t published, email support and ask directly; a vendor unwilling to answer is itself a data point.
- Sort by “inside Quebec,” “elsewhere in Canada,” and “outside Canada.” These are three different buckets under Law 25, even though “elsewhere in Canada” feels safe. If your business operates in Quebec, buckets two and three both require a PIA before the transfer, not after.
- Check whether a written agreement exists for each transfer. Section 17 requires one that reflects the assessment’s conclusions, not a generic terms-of-service click-through.
- Flag anything without a PIA on file, and start with the highest-sensitivity data. Financial records and health-adjacent fields first, general contact information last.
Five minutes gets you the list. It will not get you finished agreements with every vendor on it, and it shouldn’t try to. Major platforms like Zapier and Make already publish standard data processing agreements built for exactly this kind of review, so step four is often a matter of finding and filing the document that already exists, not negotiating a new one.
If that list surfaces gaps, the gaps are not a reason to rip out your stack. Zapier’s convenience, Make’s region choice, or n8n’s control can all fit inside a compliant setup. What they cannot do is skip the assessment for you. A process audit maps every workflow touching personal information and where each one actually sends it, before you spend time guessing.
FAQ: Data Residency for Canadian Automation
Does Zapier store Canadian business data in Canada?
No. Zapier hosts all customer data on AWS servers in the United States (US-East-1), and it does not offer region selection or Canadian data residency on any plan.
Can I make Make.com keep my data in Canada?
No. Make lets you pick a data center at signup, but the choice is EU or US, not Canada, and it is permanent for that account. Rebuilding on the other region means creating a new organization from scratch.
Is n8n Cloud data stored in Canada?
No. n8n Cloud runs on Microsoft Azure in Frankfurt, Germany, for every hosted account. The only way to keep automation data physically in Canada is to self-host the open-source version on infrastructure you control.
Does Quebec’s Law 25 apply if I only send data to Ontario or another Canadian province?
Yes. Section 17 of Law 25 is triggered by any transfer outside Quebec, not outside Canada. A supplier in Toronto or Vancouver requires the same privacy impact assessment as a supplier in Frankfurt or Virginia.
Is PIPEDA the same as Quebec’s Law 25?
No. PIPEDA is the federal law and applies mainly to interprovincial and international transfers; it makes your business accountable through contracts rather than a mandatory pre-transfer assessment. Quebec’s Law 25 sits on top of that with its own, stricter, province-specific trigger.