What data residency means for a web app#
A web app is more than its code. When you ask where your data lives, the answer covers several things:
- Your code and its builds: the source you deploy and the images built from it.
- The running app: the instances that serve your visitors.
- Your data: managed Postgres databases, SQLite files, buckets and volumes.
- What your app records: logs, traces, errors and visitor analytics.
- Backups of all of the above.
Then there is data about you as a customer: your account, your sign-in, your invoices and the email we send you. Those are handled differently, and this page says how.
Where Nimbus Land runs#
Nimbus Land runs on servers we operate in Canada, in a ServerMania data centre in Montreal. The company behind it, Nimbus Land Technologies Inc., is a Canadian company based in Saskatoon, Saskatchewan.
Customer data volumes and object storage are encrypted at rest on every storage device, and all traffic to the platform and to your apps is served over HTTPS. The Security & Trust page describes how apps are isolated from each other.
What stays in Canada#
Your applications and their data are hosted on infrastructure located in Canada, and customer content is stored in Canada by default. That includes:
- your apps, their builds and their releases;
- managed Postgres databases and SQLite files;
- buckets and volumes;
- your apps' logs, traces, errors and analytics.
Managed databases are backed up every night and continuously in between, and volumes can be snapshotted; see App dependencies and Volumes. The platform also keeps off-site backup copies; how long they are kept after you delete something is in our Privacy Policy.
What leaves Canada, and why#
Some parts of running a service rely on providers outside Canada. Every one of them is listed on the Security & Trust page with what it receives and where it operates. In short:
| Provider | What it is for | What it receives | Where |
|---|---|---|---|
| Stripe | Billing and payments | Billing contact, billing address; card details are handled by Stripe and never stored by us | United States |
| Resend | Account and notification email | Recipient addresses and the content of those emails | United States |
| Cloudflare | DNS for our domains and certificate validation | No customer content | United States |
| Let's Encrypt | HTTPS certificates | Domain names only | United States |
| GitHub, Google, Microsoft | Signing in, only if you choose one | Your profile and email address | United States |
| GitHub App | Building from repositories you connect | Repository contents for the repositories you connect | United States |
Optional AI features are off by default. Third-party AI model providers (OpenAI, Anthropic and Google) and web search for agents operate in the United States. They are used only when an organization turns them on: before anyone can use them, an owner or admin acknowledges that the content sent to them leaves Canada. See the AI gateway guide.
The Claude connector. If you connect Claude to Nimbus Land, what the connector returns (app names, logs, query results) becomes part of your conversation with Claude, which runs on Anthropic's infrastructure outside Canada. See Using Nimbus Land from Claude.
Keeping your app's data in Canada#
If you want as little as possible to leave Canada:
- Sign in with your email address rather than a GitHub, Google or Microsoft account.
- Deploy from your computer with
nimbus deployinstead of connecting a GitHub repository. See Your first app. - Leave external AI off. It stays off unless an owner or admin turns it on.
- Don't connect Claude to an organization whose data should not reach Anthropic.
Billing and account email still go through Stripe and Resend: they handle your customer account, not your app's data.
PIPEDA and contracts#
Nimbus Land is built to support our customers' obligations under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), with Canadian data residency, access controls and audit logging. A Data Processing Agreement is available on request from legal@nimbusland.ca. We will publish details of any formal certifications on the Security & Trust page as we obtain them.