Municipal clients
Data security and residency
Last verified October 7, 2026 · Spencer Morley Consulting, Edmonton, Alberta
Municipal clients working with Spencer Morley Consulting reasonably want to know where their resident and program data actually lives, and what protects it. This page sets out the infrastructure behind SMC's client-facing tools, including our online resident survey programs, in plain terms, with sources so it can be independently verified.
Where the data is hosted
SMC's client-facing tools, including resident survey programs built for Alberta municipalities, run on OVHcloud Virtual Private Server (VPS) infrastructure in OVHcloud's data centre in Beauharnois, Quebec, inside Canada.
Certifications that apply to that infrastructure
These certifications belong to OVHcloud, SMC's infrastructure provider, not to Spencer Morley Consulting as a firm. We list them because they describe the environment our client tools run in.
- ISO/IEC 27001 (information security management), ISO/IEC 27017:2015 (cloud security controls) and ISO/IEC 27018:2019 (protection of personal data in the cloud). OVHcloud lists VPS by name among the services these certifications cover, and applies them to all of its datacentres except those in the United States. OVHcloud was first certified to ISO/IEC 27001 in 2013.
- ISO/IEC 27701:2019 (privacy information management). OVHcloud's public pages don't say which services this covers.
- SOC 1, SOC 2 and SOC 3 Type 2 reports under the AICPA's SSAE 18 standard. OVHcloud's public SOC page doesn't list which products are in scope, so we don't claim SOC 2 coverage for the VPS service we use.
We're deliberately precise about scope. We don't claim OVHcloud's HIPAA or PCI DSS attestations for our hosting. If a project has a specific compliance requirement, tell us and we'll confirm it directly with OVHcloud rather than assume.
Canadian data residency
Because SMC's tools are hosted in OVHcloud's Beauharnois, Quebec facility, resident and client data collected through them is stored in Canada by default. This is relevant to municipal clients working under Alberta's POPA, BC's FOIPPA, Ontario's MFIPPA or Manitoba's FIPPA, where data residency and cross-border disclosure are recurring questions. OVHcloud, as a non-U.S. provider, positions its infrastructure as outside the reach of extraterritorial laws such as the U.S. CLOUD Act. That is OVHcloud's own positioning, not an independent legal opinion SMC has commissioned, so municipalities with a specific jurisdictional requirement should raise it with us before an engagement begins.
What SMC is responsible for
Security here is a shared responsibility. OVHcloud secures the physical data centre, network, and hypervisor layer. SMC is responsible for everything above that: serving our tools over HTTPS/TLS, restricting access to survey and client data to the project team, and agreeing data handling and retention terms with each client before a project starts.
Sources
- OVHcloud: compliance, attestations and certifications
- OVHcloud: ISO 27001, 27017 and 27018
- OVHcloud: SOC 1, SOC 2 and SOC 3
- OVHcloud service-specific terms (shared responsibility)
Compliance scopes change over audit cycles. This page was last checked against OVHcloud's published compliance pages in October 2026. Municipalities relying on a specific certification for procurement should confirm current scope directly with us or with OVHcloud.
Frequently asked
How does SMC secure client and resident data?
Through OVHcloud VPS infrastructure in Canada, HTTPS/TLS on all client-facing tools, and access limited to the SMC project team. See "What SMC is responsible for" above.
Where exactly is the data stored?
In OVHcloud's data centre in Beauharnois, Quebec, Canada.
Is the hosting infrastructure ISO 27001 certified?
OVHcloud lists VPS by name among the services covered by its ISO/IEC 27001, 27017 and 27018 certifications, which it applies to all of its datacentres except those in the United States. That includes the Beauharnois facility SMC uses. The certifications belong to OVHcloud, not to SMC as a firm.
Do Canadian municipal privacy laws require resident data to be stored in Canada?
Generally not. Alberta's Protection of Privacy Act has no data-residency provision, and section 30.1 of BC's FOIPPA, which required storage in Canada, was repealed on 25 November 2021. BC still allows disclosure outside Canada only as its regulations permit (FOIPPA s. 33.1), and B.C. Reg. 294/2021 requires an assessment in a privacy impact assessment before sensitive personal information is stored outside Canada. Nova Scotia is the main exception: its Personal Information International Disclosure Protection Act requires public bodies, including municipalities, to store and access personal information only in Canada, with limited exceptions. What the Acts do require varies by province: reasonable security arrangements everywhere, a privacy management program in Alberta (POPA s. 25) and BC (FOIPPA s. 36.2), and a privacy impact assessment in BC (FOIPPA s. 69(5.3)) and, from January 1, 2027, in Ontario (MFIPPA s. 28(3)). Contracts or funder agreements can also set a residency term of their own. Because SMC's survey tooling runs in OVHcloud's Beauharnois, Quebec data centre, resident data collected through it stays in Canada by default.
Is this the same as SMC's website hosting?
No. spencermorleyconsulting.ca is hosted separately, on commercial web hosting delivered through Cloudflare. This page is about the infrastructure behind our client-facing tools, such as resident survey programs.
Questions
Spencer Morley Consulting · Edmonton, Alberta
[email protected]