Our Data Residency Promise
Every piece of customer conversation data processed by Candidly AI, from voice recordings to AI-generated transcripts, is today stored and processed on our own Canadian infrastructure. We've built our entire infrastructure from the ground up with data sovereignty as the foundation.
Your Data Stays Within Your Borders
Unlike platforms that route data through third-party model APIs, Candidly AI runs its own models on its own infrastructure. Today that infrastructure is Canadian, and we deploy in your region so your sensitive business conversations stay where you operate.
Why Canadian Data Residency Matters
Reduced Foreign Exposure
Data stored on US soil is directly subject to US laws. By storing your data on Canadian infrastructure rather than US soil, you minimize exposure and ensure your data is primarily governed by Canadian privacy law.
Regulatory Compliance
Many Canadian organizations, especially in healthcare, finance, and government sectors, have regulatory requirements to keep personal data within Canada. Candidly AI makes compliance simple by design.
Trust and Transparency
Your candidates and customers trust you with their personal information. Canadian data residency demonstrates your commitment to protecting their privacy and maintaining the highest data protection standards.
A Note on the US CLOUD Act
We believe in transparency. Like virtually all modern SaaS platforms, Candidly AI uses infrastructure from a US-headquartered cloud provider (AWS) operating in Canadian regions. This means we cannot claim complete immunity from the US CLOUD Act.
What is the CLOUD Act?
The CLOUD Act (2018) allows US courts to compel US-headquartered technology companies to provide data for specific criminal investigations with valid warrants, even if that data is stored outside the United States.
What This Means in Practice
Important Context
- This requires a valid warrant with judicial oversight for a specific criminal investigation
- It is not mass surveillance and cannot be used for fishing expeditions
- Major cloud providers publicly commit to challenging overly broad requests
- This scenario is extremely rare for typical business data
- Most developed countries, including Canada, have similar legal tools for cross-border data access
Why Candidly AI Is Still the Better Choice
While no cloud-based service using US infrastructure can claim complete CLOUD Act immunity, Candidly AI provides meaningfully stronger data protection than alternatives:
- Canadian data residency: Your conversation content is physically stored in Canada and never routed through US servers, unlike competitors who process data in the US
- Self-hosted AI: Unlike platforms using OpenAI, Anthropic, or Google AI APIs, our AI runs entirely on our own Canadian infrastructure
- No US storage: Your recordings and transcripts are never stored on US soil, reducing exposure compared to US-hosted alternatives
- PIPEDA governance: Your data is primarily governed by Canadian privacy law
- Reduced attack surface: Fewer US touchpoints means fewer potential access points
The Bottom Line
Complete data sovereignty is complex in a connected world. By choosing Candidly AI, you get Canadian data residency with significantly reduced US exposure compared to platforms that store data in the US or route your sensitive conversations through US-based AI providers. For most organizations, this represents the practical best option for protecting sensitive Canadian data.
Our Canadian Infrastructure
Database Storage
All user data, call records, and transcripts are stored in encrypted databases located in Canadian data centres with AES-256 encryption at rest.
Audio Storage
Call recordings and voice data are stored in Canadian cloud regions, encrypted with customer-specific keys and strict access controls.
AI Processing
Our AI models run on self-hosted infrastructure in Canadian data centres. We do NOT use US-based AI services like OpenAI, Anthropic, or Google AI.
Speech Services
Voice-to-text transcription runs on our self-hosted AI models in Canadian data centres, so audio data is processed without leaving our infrastructure.
Third-Party Services
While all customer conversation content is processed and stored in Canada, the following operational services are provided by US-headquartered, SOC 2 Type II audited providers:
Enterprise-Grade Security
Multi-Tenant Isolation
- Complete data isolation between organizations
- Role-based access controls within your organization
- Comprehensive activity and access logging
Encryption Standards
- TLS 1.2+ encryption for all data in transit
- AES-256 encryption for all data at rest
- Secure key management practices
Compliance Framework
Candidly AI is designed with compliance as a core principle. Our Canadian data residency architecture supports compliance with:
For organizations with specific compliance requirements, we offer documentation and security assessments upon request.
Data Controller & Processor Roles
When you use Candidly AI to conduct interviews, you are the Data Controller and Candidly AI is the Data Processor. This means you are responsible for providing privacy notices to participants and responding to their privacy requests.
For full details, see our Privacy Policy and Terms of Service.
What We Don't Do
- No US-based AI services: We don't use OpenAI, Google AI, or other US services for processing your data
- No conversation data stored outside our infrastructure: Your recordings, transcripts, and AI analysis are stored only on our own Canadian infrastructure
- No AI training on your data: Your conversations are never used to train AI models
- No data selling: We never sell or share your data with third parties
Note on Data Export: Your data remains within Canada while stored on our platform. If you choose to export your data, you become responsible for its handling and storage once it leaves our infrastructure.
Questions About Data Residency?
Our team is happy to discuss our infrastructure, security practices, and compliance capabilities with your organization.