Our Data Residency Promise
On Candidly AI™ Sovereign, every piece of customer conversation data, from voice recordings to AI-generated transcripts, is today stored and processed on our own Canadian infrastructure. We've built our entire infrastructure from the ground up with data sovereignty as the foundation.
Candidly AI Sovereign stores conversation data in Canada
Candidly AI Sovereign runs models on infrastructure we operate in Canada, with no calls to third-party model APIs.
Why Canadian Data Residency Matters
Reduced Foreign Exposure
Data stored on US soil is directly subject to US laws. Candidly AI Sovereign stores your data on Canadian infrastructure rather than US soil, which minimizes that exposure and keeps your data primarily governed by Canadian privacy law.
Regulatory Compliance
Many Canadian organizations, especially in healthcare, finance, and government sectors, have regulatory requirements to keep personal data within Canada. Candidly AI makes compliance simple by design.
Trust and Transparency
Your candidates and customers trust you with their personal information. Canadian data residency demonstrates your commitment to protecting their privacy and maintaining the highest data protection standards.
A Note on the US CLOUD Act
We believe in transparency. Like virtually all modern SaaS platforms, Candidly AI rents its servers from US-headquartered cloud providers, Amazon Web Services and Google Cloud, both operating in Canadian regions. This means we cannot claim complete immunity from the US CLOUD Act. It is worth being precise about what that does and does not involve. On Candidly AI Sovereign, these providers host the machines our own AI models run on. They have no access to the models, and your conversations are never sent to any AI service they operate.
What is the CLOUD Act?
The CLOUD Act (2018) allows US courts to compel US-headquartered technology companies to provide data for specific criminal investigations with valid warrants, even if that data is stored outside the United States.
What This Means in Practice
Important Context
- This requires a valid warrant with judicial oversight for a specific criminal investigation
- It is not mass surveillance and cannot be used for fishing expeditions
- Major cloud providers publicly commit to challenging overly broad requests
- This scenario is extremely rare for typical business data
- Most developed countries, including Canada, have similar legal tools for cross-border data access
Why Candidly AI Is Still the Better Choice
While no cloud-based service using US infrastructure can claim complete CLOUD Act immunity, Candidly AI provides meaningfully stronger data protection than alternatives:
- Canadian data residency: On Candidly AI Sovereign, your conversation content is physically stored in Canada and never routed through US servers, unlike competitors who process data in the US
- Self-hosted AI: Unlike platforms that send your conversations to OpenAI, Anthropic or Google AI model APIs, Candidly AI Sovereign runs models on infrastructure we operate in Canada. Renting a server from a cloud provider is not the same as sending your data to that provider's AI service
- No US storage: On Candidly AI Sovereign, your recordings and transcripts are never stored on US soil, reducing exposure compared to US-hosted alternatives
- PIPEDA governance: Your data is primarily governed by Canadian privacy law
- Reduced attack surface: Fewer US touchpoints means fewer potential access points
The Bottom Line
Complete data sovereignty is complex in a connected world. By choosing Candidly AI Sovereign, you get Canadian data residency with reduced US exposure compared to platforms that store data in the US or route your sensitive conversations through US-based AI providers. For most organizations, this represents the practical best option for protecting sensitive Canadian data.
Our Canadian Infrastructure
Database Storage
All user data, call records, and transcripts are stored in encrypted databases located in Canadian data centres with AES-256 encryption at rest.
Audio Storage
Call recordings and voice data are stored in Canadian cloud regions, encrypted at rest with AES-256 and protected by strict access controls.
AI Processing
Candidly AI Sovereign runs models on infrastructure we operate in Canada, with no calls to third-party model APIs. It does NOT send your conversations to US-based AI services like OpenAI, Anthropic or Google AI.
Speech Services
On Candidly AI Sovereign, voice-to-text transcription runs on our self-hosted AI models in Canadian data centres, so audio data is processed without leaving our infrastructure.
Candidly AI Studio
Candidly AI Studio is a separate service with its own terms, and the Canadian-only processing described on this page does not apply to it. Studio data is stored in Canada. To provide Studio, we use third-party service providers that may process your data, including call audio, transcripts and the content of your conversations, in Canada, the United States and other countries where they operate. If your engagement needs Canadian-only processing, choose Candidly AI Sovereign. Details of our providers are available under NDA through our Trust Centre.
Enterprise-Grade Security
Multi-Tenant Isolation
- Complete data isolation between organizations
- Role-based access controls within your organization
- Comprehensive activity and access logging
Encryption Standards
- TLS 1.2+ encryption for all data in transit
- AES-256 encryption for all data at rest
- Secure key management practices
Compliance Framework
Candidly AI is designed with compliance as a core principle. Our Canadian data residency architecture supports compliance with:
For organizations with specific compliance requirements, we offer documentation and security assessments upon request.
Data Controller & Processor Roles
When you use Candidly AI to conduct interviews, you are the Data Controller and Candidly AI is the Data Processor. This means you are responsible for providing privacy notices to participants and responding to their privacy requests.
For full details, see our Privacy Policy and Terms of Service.
What We Don't Do
- No US-based AI services (Sovereign): On Candidly AI Sovereign, we don't send your conversations to OpenAI, Google AI or any other AI service for processing
- No conversation data stored outside our infrastructure (Sovereign): On Candidly AI Sovereign, your recordings, transcripts, and AI analysis are stored only on our own Canadian infrastructure
- No AI training on your data: Your conversations are never used to train AI models
- No data selling: We never sell your data. We share it only as our Privacy Policy describes: with the service providers that help us run Candidly AI, when the law requires it, in a business transfer, or with your consent.
Note on Data Export: Your data remains within Canada while stored on our platform. If you choose to export your data, you become responsible for its handling and storage once it leaves our infrastructure.
Questions About Data Residency?
Our team is happy to discuss our infrastructure, security practices, and compliance capabilities with your organization.