This is general information, not legal advice. It reports each vendor's own published hosting/residency claims as of September 15, 2026 — not DROZlegal's independent audit of their accuracy or completeness — and reflects Ontario-specific considerations under PIPEDA, with a note on Quebec's Law 25 where a firm has Quebec-connected clients. Vendor policies change; verify a vendor's current position directly, in writing, before relying on anything below, and consult counsel for advice on a specific matter.
Why “hosted in Canada” isn't a yes/no question for most vendors
Most legal software vendors don't publish a single clear answer to “where is my data,” and the ones that do often answer only half the question. Some name a specific hosting region. Some name a general cloud provider without a region. Some have a written policy for one segment of customers (a partnership, a large enterprise account) and nothing standing for everyone else. A few say nothing at all, which is a gap in public disclosure, not proof either way.
This post checks eight vendors Canadian firms frequently shortlist against DROZlegal, reads what each one's own trust, security, or privacy page actually says today, and marks anything that isn't stated as exactly that — not stated — rather than guessing. For the deeper distinction between a named hosting region and who can still compel access to it under laws like the U.S. CLOUD Act, see our full AWS ca-central-1 and data residency guide; this post stays focused on the narrower, comparable question — what does each vendor publish about where the data sits.
40% of Canadian respondents cite changes to Canada–U.S. data-sharing arrangements as their top regulatory concern, and 21% flag the U.S. CLOUD Act specifically as a sovereignty threat. — Kiteworks, 2026 Data Security and Compliance Risk: Data Sovereignty Report
Eight legal AI and practice-management vendors, compared on data residency
| Vendor | Where they say data is hosted / processed | Canadian hosting option, publicly stated? | Source |
|---|---|---|---|
| Clio | Optional, dedicated “Canadian Server” — Canadian firms can have their Clio Manage account provisioned on servers located in Canada, framed around PIPEDA. | Yes — a named, explicit Canadian hosting option | Clio Help Center, Canadian Server FAQ |
| MyCase | Not named. Its privacy policy says only that personal information “may [be] transfer[red]… to various jurisdictions as necessary” — no country or region specified. | Not publicly stated | 8am.com Privacy Policy (MyCase's parent company) |
| Smokeball | Hosted on AWS generally, with multi-availability-zone redundancy described; its own security page does not name a specific AWS region. | Not publicly stated on Smokeball's own published security page | Smokeball Security Policy |
| Filevine | AWS, Azure, and GCP, across multiple regions, none named specifically. Separately: one large Canadian PI firm, McLeish Orlando Lawyers, was reported in March 2026 to still be negotiating Canadian hosting with Filevine directly. | Not a standing policy — one firm's in-progress negotiation, not a general commitment | Filevine Security; Law Times, Mar. 23, 2026 |
| Harvey | Published regions across its trust and privacy centers are the US, EU, Switzerland, and Australia. | No — Canada is absent from Harvey's own published region list | Harvey Trust Center; Harvey Privacy Center |
| CoCounsel (Casetext, now Thomson Reuters) | A sibling product line's help page (CoCounsel Tax, Audit & Accounting) states plainly that prompts are “processed and hosted in the U.S.” No equivalent page was found for CoCounsel Legal specifically, the product actively marketed to Canadian firms. | Not publicly stated for CoCounsel Legal specifically, as of this post's research date | Thomson Reuters, CoCounsel Tax/Audit/Accounting security help page |
| Spellbook | General product reported to run on AWS in the U.S. and Canada. Under its March 2026 exclusive partnership with the Canadian Bar Association, Spellbook committed that CBA members' data “will be stored on Canadian soil.” | Yes — at least for CBA-partnership members, per Spellbook's own press release | Spellbook/CBA press release, Mar. 2026 |
| Actionstep | Its own published data-security page states firms “have the option to store their firm's data in any one of our four AWS data centers in Australia, Europe, Singapore, or the United States.” | No — Canada is absent from Actionstep's own published list of four regions | Actionstep Data Security page |
| DROZlegal | All backend data — database, documents, storage — hosted in AWS ca-central-1 (Canada). AES-256 encryption at rest, TLS 1.2+ in transit. Not an option among several; it's the only region DROZlegal runs in. | Yes — the default and only hosting region | DROZlegal Security & Residency Architecture |
Table checked directly against each vendor's own published trust, security, or privacy page on September 15, 2026. Vendor policies and published pages change; confirm the current position with the vendor directly, in writing, before relying on a row above.
Four things this table can't tell you
- “Not publicly stated” isn't “no.” MyCase, Smokeball, and CoCounsel Legal simply haven't published a specific region on the pages we checked. That's a gap in public disclosure a firm should ask about directly — it isn't proof the data leaves Canada, and it isn't proof it doesn't.
- A negotiated arrangement isn't a standing policy. Filevine's Canadian-hosting story exists because one firm asked and is working through it with the vendor as of the reporting date. It isn't a checkbox every new Canadian customer gets by default, and a firm evaluating Filevine today should put that exact question in writing before signing rather than assume McLeish Orlando's arrangement extends to them.
- A named region answers “where,” not “who can still compel access.” Since September 22, 2023, Quebec's Law 25 has separately required a documented privacy impact assessment before any transfer of personal information outside the province — a distinct legal trigger from the hosting-region question this table answers. See our AWS ca-central-1 guide for the full region-versus-control breakdown, including the U.S. CLOUD Act nuance a clean “yes, Canada” answer doesn't resolve on its own.
- Backups and sub-processors can sit outside the named primary region. None of the pages checked above published a sub-processor list alongside their residency claim. A vendor that names Canada for primary storage may still route backups, analytics, or a support sub-processor elsewhere — ask for that list separately, in the data-processing addendum, not the marketing page.
Where DROZlegal fits on this same question
DROZlegal is one of the nine rows above, not a neutral referee, so this section stays as checkable as the rest of the table. Client data — the database, uploaded documents, and generated drafts — is stored in AWS ca-central-1 (Montréal) and never leaves Canada; encryption is AES-256 at rest and TLS 1.2+ in transit. That isn't a tier or an add-on: it's the only region the platform runs in, for every customer, by default. AI processing runs under Anthropic's commercial API terms — inputs and outputs are never used to train a model, and both are auto-deleted within approximately 30 days. That is deliberately not a zero-retention claim; it's a narrower, specific one, and the same precision is worth holding every vendor above to. The full security and residency architecture is documented for review.
Questions to put in writing before you sign
A vendor's marketing page is a starting point, not a data-processing addendum. Before renewing or signing with any vendor in the table above — including DROZlegal — get these in writing:
- The specific hosting region, named — not “Canada” or “North America,” but the actual data center or cloud region.
- Whether that region applies to all customers by default, or only to a specific tier, partnership, or negotiated arrangement.
- The sub-processor list, including where backups, analytics, and support tooling run.
- Who owns and controls the company processing the data, since a named Canadian region doesn't by itself resolve exposure to foreign compelled-disclosure laws.
- What happens to the data, contractually, if the vendor is acquired or changes hosting providers.
Not ready to subscribe? Join the DROZlegal waitlist instead.