Not by itself. Hosting decides where data sits; ownership decides which country's law can reach the company that holds it. Under 18 U.S.C. § 2713, which the U.S. CLOUD Act added in 2018, a provider covered by that law must preserve or disclose data in its "possession, custody, or control" whether the data is stored inside or outside the United States, so a Canadian data centre does not settle the question on its own. For email signature software, ask two things: where is the data, and who owns the vendor?
This is not legal advice. Whether a given provider can be compelled by a foreign authority depends on its corporate structure and on the law of each country involved. For your organization's situation, ask a lawyer.
Does Canadian hosting protect my data from U.S. law?
The text of the statute is short. 18 U.S.C. § 2713 says that a provider of electronic communication service or remote computing service "shall comply with the obligations of this chapter to preserve, backup, or disclose" communications and records "within such provider's possession, custody, or control, regardless of whether such communication, record, or other information is located within or outside of the United States." The section was added by Public Law 115-141 on March 23, 2018. The U.S. Department of Justice keeps the official materials on its CLOUD Act resources page.
The Government of Canada reaches the same point from the customer's side. In its white paper on data sovereignty and public cloud, the Government of Canada writes that government data is entrusted to a third party "that may be subject to the laws of a foreign country, even if the data resides in Canada", and that "as long as a CSP that operates in Canada is subject to the laws of a foreign country, Canada will not have full sovereignty over its data." That paper is about the federal government's own use of public cloud services, and the page shows no date, so we cite it for the principle and not as a rule that binds a private organization.
What neither source tells you is whether a particular vendor falls within reach of U.S. legal process. That turns on the vendor and its parent, which is exactly why ownership is the question to ask. Our guide on email data sovereignty covers the difference between residency and sovereignty in more detail.
Why does ownership matter as much as hosting?
Three things are easy to confuse on a product page:
- Residency: in which country the vendor's servers and backups sit. See Canadian data hosting.
- Ownership: which company owns and controls the vendor, and under whose laws that company operates.
- Architecture: whether your email passes through the vendor at all, or stays in Microsoft 365. See architecture without email routing.
One recent analysis puts numbers on the gap between the first two. In an April 21, 2026 commentary for Policy Options, at policyoptions.irpp.org, Joshua van Es, who works in corporate law in Vancouver and founded the research platform Upper Harbour, describes a dataset of more than 750 software-as-a-service platforms used by Canadian organizations. He writes that "two-thirds of the tools analyzed in our dataset are operated by companies subject to the CLOUD Act, while only 17 per cent are Canadian-owned", and that "among the 201 tools that offer Canadian data residency — often cited as a sovereignty safeguard — one in three remain under U.S. parent jurisdiction." For communications tools, "the platforms used for internal email, video calls and messaging", he reports that 91 per cent fall under foreign jurisdiction.
These figures are one author's analysis, built on his own dataset and method; they are not an IRPP study and not a ranking of email signature vendors. We cite them because they show that a hosting region and an owner's nationality are two separate facts.
What does the Privacy Commissioner say about foreign providers?
The Office of the Privacy Commissioner of Canada (OPC) explains how the federal private-sector law, PIPEDA, applies to transfers of personal information to a third party for processing in its guidelines for processing personal data across borders (page dated January 27, 2009). Four points matter here:
- You stay accountable. PIPEDA does not prohibit sending personal information to another jurisdiction for processing, but "organizations are held accountable for the protection of personal information transfers under each individual outsourcing arrangement."
- The contract does the main work. The organization must use contractual or other means to "provide a comparable level of protection while the information is being processed by the third party".
- A contract has limits. "What the organization cannot do through contract - or indeed by any other means - is to override the laws of a foreign jurisdiction."
- Be transparent. Organizations must advise customers that their information may be processed in another jurisdiction, where it may be accessed by courts, law enforcement and national security authorities.
The guidelines date from 2009 and are about PIPEDA; provincial laws and sector rules may add to them, and public bodies often have their own. They do not tell you which vendor to choose. They tell you what to be able to say about the one you chose.
What should I ask an email signature vendor?
Put the same short list to every vendor, in writing, and keep the answers with your records:
- Who owns the vendor, including any parent company? Ask for the jurisdiction of incorporation of each.
- Where are the data and the backups? Both, by country.
- What does the tool read? Ask for the exact Microsoft Graph permissions, and whether any email content is read; see how a dynamic signature uses Microsoft Graph.
- Does your email pass through the vendor's servers? A signature can be applied without relaying the message.
- Which sub-processors touch the data, and where?
- What does the contract say about a request from a government authority?
To compare vendors on price and features, see email signature software in Canada.
Where does ATOM Signatures stand on these questions?
These are facts about our own product, and we limit ourselves to them:
- Owner: ATOM Solutions, a Canadian company.
- Hosting: in Quebec. Backup copies are encrypted and kept in Toronto, Ontario. The privacy policy names the sub-processors that may handle information outside Quebec or Canada.
- What it reads: your Microsoft 365 directory, through Microsoft Graph in application mode and read-only, with the permissions
User.Read.AllandGroupMember.Read.All. - What it does not do: it reads no email content and relays no email.
We do not state, in either direction, how U.S. or any other foreign law applies to ATOM Solutions; that is a question for your lawyer, with our contract in front of you. And your mailboxes stay in Microsoft 365, which ATOM does not replace: Microsoft's own terms and jurisdiction remain part of your assessment whichever signature tool you use.
Related reading: completing a POPA PIA for an email signature tool and what RECO expects in a real estate agent's signature.
Frequently asked questions
Does Canadian hosting protect my data from U.S. law?
Not by itself. Under 18 U.S.C. § 2713, a provider covered by that law must preserve or disclose data within its possession, custody or control whether the data is located inside or outside the United States. Whether a given vendor is covered depends on the vendor and its parent, so ask who owns it as well as where it hosts.
What is the difference between data residency and ownership?
Residency is where the data and backups are stored. Ownership is which company controls the vendor and under whose laws it operates. One analysis published in Policy Options in April 2026 reports that, of 201 tools offering Canadian data residency, one in three remain under U.S. parent jurisdiction.
What does the Privacy Commissioner say about using a foreign provider?
The OPC's guidelines, dated 2009, say PIPEDA does not prohibit sending personal information abroad for processing, but the organization stays accountable, must use a contract to provide a comparable level of protection, and cannot override the laws of a foreign jurisdiction by contract. It must also be transparent with the people concerned.
Is ATOM Signatures a Canadian-owned company, and where is it hosted?
ATOM Signatures is published by ATOM Solutions, a Canadian company. It is hosted in Quebec, with encrypted backups in Toronto. It reads your Microsoft 365 directory through Microsoft Graph, read-only, reads no email content and relays no email.
Ask us the vendor questions above. ATOM Signatures costs CA$1 per user per month, plus taxes, with a 14-day free trial.
Sources
- 18 U.S.C. § 2713, Required preservation and disclosure of communications and records — law.cornell.edu
- U.S. Department of Justice, CLOUD Act resources — justice.gov
- Government of Canada, Treasury Board Secretariat — White Paper: Data Sovereignty and Public Cloud — canada.ca
- Joshua van Es, "Canada's digital sovereignty debate overlooks software risks", Policy Options (IRPP), April 21, 2026 — policyoptions.irpp.org
- Office of the Privacy Commissioner of Canada, Guidelines for processing personal data across borders, page dated January 27, 2009 — priv.gc.ca
Sources consulted on November 3, 2026. This guide is provided for information purposes and is not legal advice.