With the coming into force of Law 25 in Quebec and all the digital security issues we are currently facing, the management and hosting of business data have become strategic topics for SMEs.
Why is it important?
Today, companies are no longer just looking for a high-performing ERP: they also want to understand where their data is hosted, which jurisdictions apply, and how their sensitive information is protected.
For many Quebec companies, the historical reliance on American cloud infrastructures has long raised concerns related to data access and the enforcement of foreign laws.
At Odovia Integration, we believe that a modern ERP project must also incorporate a reflection on data governance and technological transparency. In this context, issues of digital sovereignty, security, and data governance are becoming increasingly important.
Data that will no longer be hosted in the United States
As part of the evolution of Odoo's cloud infrastructure, Canadian customer data will no longer be hosted in the United States.
The environments and backups will be distributed between Canada and Europe to provide a better balance between:
security,
resilience,
compliance,
and digital sovereignty.
This evolution directly addresses the growing concerns of Canadian businesses regarding data localization and information governance.
Odoo offers cloud environments with data residency in Canada, particularly through the Odoo.sh platform. Canadian clients' instances and databases can thus be hosted in a data center located in Toronto, avoiding the need for the main infrastructure to transit through American servers.
Technically, how can we ensure that the data remains in Canada?
Depending on the chosen hosting level, here’s how to ensure that the data remains in Canada:
Odoo.sh (PaaS cloud platform)
Odoo's PaaS solution uses Google Cloud Platform (GCP) and has a dedicated data center region in Toronto.
When creating an Odoo.sh project, it is important to explicitly select the Canada (Toronto) region to avoid having the hosting assigned by default to the United States.
Odoo Online (SaaS)
For fully managed Odoo Online environments, the assignment of the hosting region is generally done automatically based on the company's address.
It is therefore recommended to ensure that the company's profile clearly indicates a Canadian address in order to facilitate routing to the Toronto data center.
On-Premise / Odoo Enterprise Cloud (OEC)
For companies with stricter compliance and control requirements, it is also possible to host Odoo on local Canadian infrastructures, either through self-hosting or via a local partner that offers this service.
It is also possible to check the location of an existing database directly from Odoo.sh or via the Odoo database manager to view the associated GCP or AWS region for the instance.
The perspective of Odoo
For Quebec SMEs evaluating their options for cloud management solutions, regulatory compliance is an important criterion. The hosting infrastructures used by Odoo comply with recognized standards for personal data protection, notably the General Data Protection Regulation (GDPR) of the European Union.
Quebec's Bill 25 is largely inspired by the GDPR and shares several of its fundamental principles. Moreover, many specialists consider that the requirements of the GDPR are, in some respects, more stringent than those of Quebec legislation, particularly regarding the legal bases for data processing, international information transfers, and certain commercial prospecting practices. In this context, an organization compliant with the GDPR is generally well positioned to meet the requirements of Bill 25.
According to Odoo, the contractual commitments already included in the Odoo Enterprise subscription agreement, including provisions related to data processing, cover the obligations applicable to clients using the Odoo Online and Odoo.sh environments. No additional contractual amendment is normally required in this regard.
Companies wishing to delve deeper into compliance-related aspects can consult the data protection guide published by Odoo on its website (https://www.odoo.com/gdpr). It is still recommended to validate any compliance process with a qualified legal advisor to take into account the realities specific to each organization.
For more details on subcontractors and service providers involved in data processing, Odoo's privacy policy (https://www.odoo.com/privacy#part_6) also provides detailed information, see the section "Third-party Service Providers / Subcontractors".
Questions regarding the protection of personal information can be addressed directly to the team responsible for privacy at Odoo (privacy@odoo.com).
Do you have questions about Odoo hosting?
Our team can assist you in evaluating the different hosting options based on your operational needs, security requirements, and compliance issues.
Contact Odovia Integration to discuss.