What does Canadian data residency mean for a training system?

Which data does residency usually cover?

The data the system stores, rather than the data it transmits. For a training platform that normally means completion records, enrollment history, uploaded course content and SCORM packages, assessment results, issued certificates, and the directory holding learner names and email addresses.

Backups and disaster-recovery copies are part of the same question and are easy to overlook. A vendor can hold primary data in one country and replicate backups to another. Ask where backups live, not just where the database runs.

Does data residency mean the same thing as data sovereignty?

No, and this is the distinction most often skipped in vendor answers. Residency describes a physical location. Sovereignty asks which legal system can reach the data, which depends on where the operator and its parent company are incorporated, not only on where the disk is.

A cloud region inside Canada operated by a company incorporated elsewhere gives you residency. Whether it gives you sovereignty is a legal question, and it depends on your own risk posture and sector. This page does not answer it. A vendor who answers it for you in a sales conversation is going further than they can support.

What normally leaves the region even when residency is claimed?

Three flows commonly cross a border even when the core claim is honest.

1. Transactional email. Notices and reminders are delivered through an email provider. The message body and the recipient address travel with it.
2. Support access. A support engineer in another country viewing a record is a transfer, even if nothing is copied.
3. Telemetry and error reporting. Crash traces and performance data often go to a service hosted elsewhere, and can contain identifiers.

None of these makes a residency claim false. They make it partial. A vendor who names them is describing their system; a vendor whose answer has no carve-outs at all has usually not looked.

How do you verify a residency claim?

Ask for three things in writing, and treat anything less as marketing.

1. The named cloud region, not the country. "Hosted in Canada" is not checkable. "AWS ca-central-1" is.
2. The current sub-processor list, with what each party does and where it operates.
3. The carve-outs, meaning every flow that leaves the stated region, with the reason.

Then check that the list is dated and that someone maintains it. A sub-processor page last updated three years ago tells you about the vendor's process, not about their processors.

How does EmbayLMS handle this?

EmbayLMS stores learning data at rest in AWS ca-central-1, the region Amazon publishes as Canada Central, located in Montreal. That covers learning records, course content, assessments, certificates and the user directory.

The known carve-outs are processing, not storage. Transactional email is delivered from the United States, and the background worker tier runs on a US-hosted platform. Each one is stated rather than buried. The current list of every third party that processes customer data is published, with each party's role and location.

This page explains general concepts and describes how one product is configured. It is not legal advice, and it does not state what any law requires of your organization.