Canadian numbers into your own deployment
Numbers are provisioned or ported to terminate in your environment, so the call path stays as short and as domestic as the deployment does.
Locations
On-premise AI voice agents with Canadian data residency
For organisations whose review board will not approve call audio leaving the country — and a straight answer about when Canadian law actually requires that, which is less often than you have been told.
The basics
When self-hosting is the right answer in Canada
Self-hosting is the right answer when your own governance requires it, when Quebec's transfer rule applies, or when the review would cost more than the deployment. It is worth being blunt about the reasoning, because the sector is full of vendors implying that Canadian law forbids data leaving the country. It does not, as a general matter. What is true is that some organisations have internal policies or contractual commitments that require in-country processing, that Quebec imposes a genuine procedural step before information leaves the province, and that for a hospital or a credit union the cost of getting a cross-border transfer through review can exceed the cost of simply not having one. Those are three good reasons. The imaginary legal prohibition is not one, and we would rather you bought this for a real reason.
In short
- The platform running inside your own cloud account or your own hardware
- Recordings, transcripts and caller records that never leave your environment
- No sub-processor chain to document, because there is no third party in it
- A clean answer for Quebec's assessment requirement
- Your retention and deletion policy applied by you, not requested from a vendor
The market
The review that stalls a Canadian deployment
In regulated Canadian organisations the voice AI project rarely dies at the demo. It dies four months later in a privacy review, when somebody works out that call audio containing patient or member information would be processed by a vendor's infrastructure, which in turn depends on three subprocessors, one of which is offshore. At that point the project does not get rejected so much as indefinitely deferred, because nobody wants to be the person who signed off the transfer and the paperwork to do it properly is genuinely substantial.
Self-hosting changes the shape of that conversation rather than the difficulty of the technology. When the platform runs inside infrastructure the organisation already owns and has already had assessed, the questions become ones the internal team can answer without a vendor questionnaire: which of our environments, under whose access controls, retained for how long. For hospitals, credit unions, insurers, universities and municipalities that is frequently the difference between a project that launches and one that quietly becomes a line in next year's plan.
Not required
Canadian storage, under federal law
The federal guidance is explicit that personal information need not be stored in Canada; what is required is accountability, comparable protection and transparency about transfers.
Art. 17
Quebec's genuine extra step
Communicating personal information outside Quebec requires a prior assessment of privacy-related factors, plus a written agreement reflecting its conclusions.
Agent
What the platform is under Ontario health law
A clinic or hospital is the custodian of health information; anything handling it on their behalf is an agent, permitted to act only as the custodian allows.
Who is calling
Who deploys inside their own environment here
Hospitals, clinics and health organisations
Where the custodian relationship makes an external processor a documentation exercise and an internal deployment simply avoids it.
Finance
Credit unions and insurers whose member data governance was written long before anybody proposed putting a voice agent in front of it.
Education
Universities and colleges with their own infrastructure, their own review boards and admissions lines that overwhelm every September.
What the rules require
What actually drives a Canadian residency requirement
Four things worth separating clearly, because they get collapsed into one claim by nearly everyone selling in this space.
Federal transfer guidance
The claim we are not going to make
The federal position is that transferring personal information to another jurisdiction for processing is not prohibited, and that information does not have to be stored in Canada. What is required is that the organisation remains accountable for information in a third party's hands, uses contractual or other means to provide a level of protection comparable to what it would have received at home, and is transparent that the information may be sent elsewhere and may be accessible to courts and authorities there. If a vendor tells you Canadian law requires residency, they are either mistaken or hoping you will not check, and either should affect how you weigh the rest of what they tell you.
Quebec, Law 25, Article 17
Where a real procedural requirement does apply
Quebec is the exception that is genuinely different rather than rhetorically different. Communicating personal information collected in Quebec outside the province — including to another Canadian province — requires a prior assessment of privacy-related factors weighing sensitivity, purpose, the protective measures including contractual ones, and the legal framework in the destination, with the transfer permitted where that assessment establishes adequate protection and a written agreement reflecting its conclusions. That is a documented process with a cost attached. Deploying in-province removes the requirement rather than satisfying it, which for many Quebec organisations is the cheaper path.
Provincial private-sector acts
Three provinces where the applicable statute changes
Alberta, British Columbia and Quebec each have a private-sector privacy act declared substantially similar to the federal statute, generally displacing it for collection, use and disclosure occurring inside that province, while the federal act continues to reach information that crosses a provincial or national border and federally regulated organisations wherever they operate. For a national organisation this means a cross-border transfer can engage several regimes at once. A deployment that stays inside one environment inside the country collapses much of that complexity into a question about your own access controls.
Ontario health information law
Custodians, agents, and why hospitals self-host
Ontario health information sits with a custodian — the hospital, clinic or practitioner group — and anything handling that information on the custodian's behalf is an agent, permitted to collect, use, disclose, retain or dispose of it only as the custodian allows and only where necessary for its duties. That framing is workable with a hosted vendor and considerably simpler when the software runs inside the custodian's own environment, because the question of what a third party may do with the information stops arising. It is the single most common reason Ontario health organisations choose the self-hosted route.
Written from the regulators' published guidance rather than as legal advice. If your organisation's own policy requires in-country processing, that policy is a perfectly sufficient reason to self-host and we are not going to argue you out of it — we would just rather you knew which requirement you were satisfying.
Numbering
Numbering when the platform is inside your environment
Self-hosting changes where the software runs, not how the telephone network reaches it, and the numbering work looks much as it does on a hosted deployment.
Your existing telephony, not a replacement for it
The agent sits behind the numbers and the trunks you already run, which is usually what makes the internal approval straightforward.
Attestation on outbound
Numbers registered to the deployment carry a strong caller-ID attestation, which matters for the reminder and notification calls that dominate regulated outbound.
No audio leaving the boundary
Recording, transcription and summarisation all happen inside your environment, which is the property the whole deployment exists to provide.
Area codes we provision in:416 / 647613 / 343514 / 438604 / 778403 / 587780 / 825902 / 782204 / 431306 / 639418 / 581819 / 873250Explore more in the app
Capabilities
What runs inside your environment
The capability set is the same as the hosted product. What changes is where it executes, who holds the keys, and how many third parties are in the answer.
Direct access to systems that never face the internet
The agent reads from record systems inside your own network, which is frequently impossible on a hosted deployment at any price.
Recordings that stay inside the boundary
Audio, transcripts and summaries all produced and retained within your environment, under your retention schedule.
Language coverage well beyond the hosted six
Licensed deployments extend past twenty-five languages, which matters for public-sector and health organisations serving varied communities.
Into the systems you already run
Including the ones that are not cloud products and were never going to be exposed to a vendor.
Customizable Responses
Shapes exactly how your agent talks, scripts, tone, and guardrails, so it stays on-brand and on-policy on every call.
Analytics
Call volume, resolution rates, and outcomes in one dashboard, so every conversation turns into a decision.
Coverage
Where Canadian self-hosted deployments run
The markets our Canadian on-premise conversations come from. In this case the location that matters is your infrastructure, not any city on this list.
- Toronto
- Ottawa
- Montreal
- Vancouver
- Calgary
- Edmonton
- Halifax
- Winnipeg
- Quebec City
- Regina
- Victoria
- Hamilton
- London
- Saskatoon
- Fredericton
- St. John's
- Sherbrooke
- Kingston
- Explore more in the app
The point of a self-hosted deployment is that the answer to where does it run is your own environment. We deliver the build remotely and hand it over; after that the geography is entirely yours.
Further reading
Before you scope a Canadian deployment
Sources
- Office of the Privacy Commissioner of Canada — Guidelines for processing personal data across borders. https://www.priv.gc.ca/en/privacy-topics/airports-and-borders/gl_dab_090127/ · read September 3, 2026
- McCarthy Tétrault — Sweeping privacy reform comes into force in Quebec (Law 25, Art. 17). https://www.mccarthy.ca/en/insights/blogs/techlex/sweeping-privacy-reform-comes-force-quebec · read September 3, 2026
- Office of the Privacy Commissioner of Canada — Provincial laws that may apply instead of PIPEDA. https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/r_o_p/prov-pipeda/ · read September 3, 2026
- Information and Privacy Commissioner of Ontario — Frequently Asked Questions: Personal Health Information Protection Act. https://www.ipc.on.ca/sites/default/files/legacy/2015/11/phipa-faq.pdf · read September 3, 2026
- Government of Ontario — Personal Health Information Protection Act, 2004, S.O. 2004, c. 3, Sch. A. https://www.ontario.ca/laws/statute/04p03 · read September 3, 2026
Rules change, and court decisions change them faster than regulators republish. Every statement above was read from the source shown on the date shown. Confirm the current position with your own counsel before relying on it.
FAQ
Questions from Canadian privacy officers
What Canadian privacy officers and CIOs ask first.
Generally, no — and we would rather tell you that than sell you something on a false premise. The federal guidance says plainly that personal information need not be stored in Canada and that transfers for processing are not prohibited; what is required is that you stay accountable for the information, secure a comparable level of protection by contract or other means, and are transparent that it may be processed elsewhere. Quebec is the meaningful exception, requiring a documented assessment before information leaves the province. Your own policy may still require residency, and that is a perfectly good reason to self-host.
The third parties. On a hosted voice deployment the audio typically passes through several processing components, each of which is a party your review has to identify, assess and paper. When the platform runs inside infrastructure you already own and have already had assessed, those questions collapse into ones your own team can answer: which environment, under whose access controls, retained how long, deleted by what schedule. That is usually the difference between a review measured in weeks and one measured in quarters.
Yes, and most organisations do. The deployment goes into your own cloud account in a Canadian region, which for the great majority of governance frameworks satisfies the same requirement as physical hardware while being considerably easier to operate. Own-hardware deployments still happen where a policy is written that way or where the network genuinely does not reach outward. Which shape suits you is a scoping conversation, and the licensing page covers what each involves.
It removes the requirement rather than satisfying it, which is a better outcome. Quebec requires a prior assessment of privacy-related factors before personal information is communicated outside the province, along with a written agreement reflecting the conclusions. If the information never leaves the province because the platform runs inside your own environment there, that obligation is not triggered. For organisations that would otherwise be running the assessment repeatedly as the deployment evolves, that is frequently the whole business case.
The infrastructure and its operation: capacity, patching, backups, monitoring and access control all become yours, because that is the flip side of nothing leaving your boundary. For an organisation that already runs a data centre or a mature cloud footprint this is usually marginal work absorbed by an existing team. For one without that capability it is a real cost that should go into the comparison honestly rather than being discovered afterwards — and if that describes you, the hosted product with a properly documented transfer is often the better answer.
Connect with our experts
Let’s map your calls
Tell us which environment you would deploy into and which regulator your board answers to, and we will scope the architecture and the handover before anything is quoted.
Book a discovery call