Odoo holds a lot of personal information: customers, employees, suppliers, sometimes payroll. If you are a Quebec company, Law 25 makes one question unavoidable: where is that data hosted, and who can reach it? This article explains what to check. It is not legal advice; your privacy officer or lawyer has the last word.
What Law 25 asks about hosting
Since September 2023, before personal information is communicated outside Quebec, including when it is hosted on servers outside the province, a business must carry out a privacy impact assessment. The assessment looks at how sensitive the information is, why it is sent, the protection measures in place (contractual ones included) and the legal framework where it goes. The information may only go there if it will be adequately protected.
Where Odoo keeps your data
"Our Odoo is in Canada" is often only half true. Ask about each piece:
- the database (records, customers, employees);
- the filestore (attachments, signed documents, images);
- backups, and where copies are kept;
- logs and monitoring data;
- test copies of production, and who uses them.
Choosing the region on AWS
AWS has two Canadian regions: Canada (Central) in Montréal and Canada West in Calgary. In your own AWS account, you choose the region, and the database, files and backups stay there. Montréal keeps hosting in Quebec; Calgary keeps it in Canada.
AWS is a US company: what that means
Hosting in Canada does not change who AWS is. What you can control is the rest: data encrypted at rest and in transit, an account in your company's name, access that you grant and can remove, and access logs that belong to you.
Why your own account matters
With shared hosting, the provider owns the account, the backups and the logs. With your own account, you decide who gets in, you see who did what, and you can end your provider's access at any time while everything keeps running. That makes your privacy assessment easier to document.
Questions to ask any Odoo host
- In which region are the database, files and backups stored?
- Who owns the account they sit in?
- Who can access production, and how is that access logged?
- Is the data encrypted, and who holds the keys?
- If we leave, what do we take with us, and how fast?
Talk it through
A free discovery call is a good place to map where your Odoo data lives today. More about the service: sovereign Odoo hosting on AWS.