Varennes
IT services in Varennes: knowing where your data lives
Sooner or later a customer, an insurer or an auditor asks it: your emails, your files, your backups, where are they exactly? OKTO Solutions hosts data in Canada by default and puts the location in writing. Our office is in Trois-Rivières, about 147 km from Varennes.
For a small business in Varennes, OKTO Solutions hosts data in Canada by default: Microsoft 365 in the Canadian tenant, Azure in the Canada Central or Canada East regions, and backups inside the country. The migration plan names the chosen region. Law 25 also expects a business to know who reaches the information, how long it is kept and what to do when an incident happens.
Where is the data of a Varennes business hosted when OKTO manages it?
OKTO Solutions offers its services to SMBs in Varennes from its office in Trois-Rivières, about 147 km away, and hosts their data in Canada by default. Microsoft 365 sits in the Canadian tenant, where data at rest remains in the country. Servers and applications placed in Azure go to one of the two Canadian regions, Canada Central or Canada East, and backups stay in Canada too. The chosen region appears in the migration plan, and any exception is documented, then approved by the client before it is applied. For Law 25, location is only one piece of the answer: a business also has to know who reaches personal information, how long it is kept and what to do if an incident occurs. OKTO handles the technical side of that file and gives no opinion on whether a company is legally compliant. No technician is stationed in Varennes: the follow-up is done remotely.
The data packet travels to Canada Central, then to Canada East. Either way it never leaves the country.
On the map
Canada Central or Canada East: where are those two regions?
Azure splits its infrastructure into regions, and two of them are in this country. Canada Central is in Toronto, Ontario. Canada East is in Québec City. When a Varennes company moves a server or a database to the cloud with us, it is created in one of the two, unless a different request has been put in writing.
That choice is not made at the last minute. It is settled when the migration plan is drafted, after the inventory, and it is recorded with the reason behind it. The day someone asks where your data is, the answer fits on one line, and it carries a date.
One detail matters for a business here: Canada Central is in Canada, yet outside Quebec. Law 25 does not forbid sending personal information outside the province. It asks for an assessment before you do, and the transfer can go ahead if that assessment shows adequate protection.
Microsoft 365 follows the same logic. The tenant is Canadian, and what it holds, mailboxes, OneDrive files, SharePoint sites, is stored at rest in Canada.
The record
What is hosted where, system by system?
A small business never keeps its data at a single address. These are the five cases an inventory turns up, and what gets noted for each.
| What is hosted | Where it sits | What goes in the file |
|---|---|---|
| Email, OneDrive, SharePoint and Teams | Microsoft 365, Canadian tenant, data at rest in Canada | The tenant, the licences and the people who administer it |
| Servers, applications and databases built in Azure | Canada Central or Canada East region | The region chosen, why it was chosen, roles and access |
| Backups | Kept in Canada | What is copied and, from the Standard plan up, the result of the restore tests |
| A server kept on your premises | With you, in the server room | Why it stays on site, and where its backup copy goes |
| Third-party software: payroll, newsletter, online tools | With the software vendor, to be checked one by one | The vendor’s name and what its contract says about protecting the information |
We draw up the list of vendors that touch your data; the contract itself is signed between your management and each of them. See also the backup and disaster recovery page.
The framework
What does Law 25 expect when data is in the cloud?
Five points keep coming back, drawn from the Quebec statute that protects personal information in the private sector. None of them bans the cloud.
- Assess before information leaves Quebec. The assessment looks at how sensitive the information is, why it is used, the safeguards in place, contractual ones included, and the legal framework of the destination. The transfer can go ahead if the assessment shows adequate protection, and it is covered by a written agreement (s. 17).
- Assess before any new system. Buying, building or overhauling a system that touches personal information calls for a privacy impact assessment (s. 3.3). It is best kept in writing.
- Bind every vendor with a written contract. The mandate spells out the measures taken to protect confidentiality (s. 18.3).
- Take reasonable security measures. The law gives no list: measures are judged against, among other things, the sensitivity of the information, its quantity and its medium (s. 10). In practice: multi-factor authentication, encryption, access control, logging and verified backups.
- Keep nothing longer than needed. Once the purpose of the collection is fulfilled, the information is destroyed or anonymized, unless a law sets a retention period (s. 23).
The inventory
Which data counts as personal information?
More than people expect. The law protects any information about a natural person that allows that person to be identified, directly or not. A name, an email address, an employee file, a customer file number. A single ordinary customer record easily holds six.
That is why “where is our data” cannot be answered by looking at the server alone. Personal information is scattered: on workstations, in mailboxes, in SharePoint and OneDrive, in backups, in third-party applications. The technical inventory exists to draw that map.
With the map in hand, what follows is ordinary work. Permissions get reviewed, former employees’ accounts are removed, laptops and removable media are encrypted, and what gets consulted is logged. Each measure is written down with its date, because that is the proof you will be asked for one day.
The decisions stay with you. Your management sets the retention periods and names the person in charge of personal information. We then apply those periods inside the tools.
Client managerImprimerie Saint-Maurice inc. Sample screen with a fictional record: six fields in it identify a person, from the name to the file number.
The ground
Varennes, about 147 km from our office
Varennes is a city in Montérégie, in the Marguerite-D’Youville regional county municipality. It runs along the St. Lawrence River and is served by Autoroute 30 and Route 132.
OKTO has no address in Varennes. Everything starts from Trois-Rivières. Monitoring, patching and the management of Microsoft 365 and Azure are done remotely. A trip is scheduled when the mandate calls for work on the equipment itself, under the terms of the contract. For Varennes we promise no on-site response time.
Day-to-day support covers business days, 8 a.m. to 5 p.m. In the evening and on weekends, an outage that stops the business is reported on the emergency line. The Complet plan includes it; with Base and Standard it is added as an option. The three levels are laid out on the packages page, and the rest of the territory on the service areas page. To find out where your data is today, write to us through the contact page.
Questions and answers
Your questions about data hosting in Varennes
Do you have an office or a technician in Varennes?
Do our Microsoft 365 emails and files leave Canada?
Canada Central or Canada East: who picks the Azure region?
Is hosting our data in Canada enough for Law 25?
Can we keep a server in our Varennes premises?
Where are our backups kept?
Do you know where your data is this morning?
Tell us what you use: Microsoft 365, a server at the office, an online payroll tool. We come back with what is in Canada, what is not and what still has to be documented.
Reviewed by Antonio Pazzi, president of OKTO Solutions · updated