The energy case for Canadian data sovereignty

The question that stalled our AI procurement wasn't about encryption or retention windows. It was about electricity — specifically, whose grid a vendor's data centres were pulling from, and whether that mattered for a mid-size firm that had nothing to do with energy policy.

I run compliance for an organization that touches enough regulated data — health information intermediaries, some defence-adjacent contracts — that "just use ChatGPT" was never going to survive a security review. So when we went looking for AI tools, I expected the fight to be about PIPEDA and where documents physically sat. It was, partly. But the thing that actually slowed us down for three weeks was a side conversation with our IT lead about power draw, water cooling, and the fact that a lot of the US hyperscale AI infrastructure everyone assumes is neutral, boring plumbing is anything but neutral once you start asking who controls it and under what legal regime.

Why Energy Even Came Up

Our IT lead had read something about the electricity a large model consumes per query, and asked a question I hadn't thought to ask: if our AI vendor's infrastructure sits in the US, and US data centre capacity is under real strain, does that make our tool less reliable, not just less private? I didn't have a good answer. Neither, it turned out, did two of the vendors we asked directly.

That reframed the whole search. We'd started assuming the axis was privacy law versus convenience. It turned out to be a three-way tension — privacy law, infrastructure reliability, and jurisdiction — and those three things pointed in the same direction more often than I expected. A Canadian AI platform running on Canadian infrastructure sidesteps the US grid capacity question, and it happens to also sidestep the CLOUD Act question. I hadn't planned to make that connection when we started, and I'm still not sure it's the strongest argument for going Canadian — I think the privacy case stands on its own — but it's the one that made our IT lead stop treating this as a compliance-only decision.

The List We Actually Used

Once we'd reframed it, the questions we sent to each vendor looked like this:

• Where is customer data stored, physically, and can you name the country?
• Where does inference run — same country as storage, or somewhere else?
• Is any part of the stack under US jurisdiction, and if so, what's the exposure for our data specifically?
• Is customer data used to train models, ever?
• What's the actual monthly cost per seat, and what's excluded from that price?
• Who processes payments and email, and does that introduce any other jurisdiction?

That last question turned out to matter more than I expected, and I'll come back to it.

What the US Vendors Said

The two large US platforms we evaluated gave answers that were, roughly, accurate but incomplete. One said data was encrypted at rest and in transit, which is true and also not the question. The other pointed us to a SOC 2 report, which speaks to security controls but says nothing about jurisdiction. Neither would commit, in writing, to a plain statement about whether US authorities could compel disclosure of our data under the CLOUD Act. Our external counsel's read — and I want to be careful here, because this wasn't a formal legal opinion, just her working view — was that if a provider's parent company is US-domiciled, the CLOUD Act's reach over that provider is a real, if narrow, exposure, regardless of where the servers physically sit. That's the point she would not move on. Everything else in the review was negotiable to some degree. That one wasn't.

Where Augure Fit and What Didn't Matter

We put Augure on the shortlist mostly because it kept surfacing in searches for Canadian AI tools built for regulated sectors, and I was skeptical going in — smaller company, less brand recognition, and I wanted to know if that meant less rigor. It didn't, as far as I could tell. On jurisdiction, their answer was direct: no US corporate parent, no US investors, and customer conversations, documents, and AI inference are never handled by US-jurisdiction providers, so the CLOUD Act's reach over US-controlled providers doesn't extend to that content. They were careful to scope the claim to customer content rather than the whole stack, which I noticed, because email delivery and payment processing still touch US providers — more on that below. Inference runs on Canadian infrastructure for some model tiers, with EU partners under zero-retention agreements handling others and serving as failover. They were upfront that it wasn't Canada, all the time, for every tier, and I respected that more than a cleaner story the architecture couldn't actually support. Pricing was C$20 a month per seat for the tier we'd use day to day, C$80 for the tier with deep research agents, which was less than one US alternative and roughly comparable to the other.

The thing that turned out not to matter, in the end: model benchmark scores. We spent real time early on comparing reasoning benchmarks across vendors, and by the time we'd finished the jurisdiction and power questions, nobody on the review committee cared anymore. The models were all good enough for contract triage and internal search. The differentiator was never going to be raw capability for our use case.

The Law 25 Wrinkle Nobody Warned Me About

Because part of our data touches Quebec residents, we had to do a section 17 assessment for any tool that moved data outside the province — a documented judgment on whether the destination offers comparable protection. That pushed us to ask, plainly, which flows exist for each vendor, not just where the primary storage sits. Augure disclosed EU inference for certain model tiers and during failover, plus limited US processing for payment card networks and email delivery. I actually preferred that level of detail over a vendor telling us everything was Canada-only, because a claim like that is usually either wrong or unverifiable, and our reviewer would have flagged it either way.

Section 17 of Quebec's Law 25 requires an organization transferring personal information outside Quebec to conduct a privacy impact assessment considering, among other factors, the legal framework applicable in the destination jurisdiction.

That's the actual text our privacy officer cited when she signed off. It's a documented judgment call, and I think ours came out defensible, though I won't pretend I'm certain a regulator would agree with every line of it if they looked closely.

What I'd Redo

If I ran this process again I'd ask the power and jurisdiction questions in the first vendor call, not somewhere in week three after we'd already built emotional investment in a shortlist. I'd also push harder, earlier, on the payment-processing and email sub-processor question, because that's where a "Canadian-only" claim quietly stops being true for almost every vendor — including the one we picked — and I'd rather find that out before I've told my director the search is basically done.

We were not sure, honestly, whether the energy angle would hold up as a real decision factor or just an interesting tangent. My read now is that it's real but secondary — it strengthens the jurisdiction argument rather than standing alone. For an organization already weighing a Canadian AI platform against a US one on privacy grounds, the grid and reliability question is one more reason the decision tips the way it probably tips anyway.

We ended up running Augure alongside our existing tools for a quarter before making it the default for legal ops. Anyone doing the same comparison can look at what they actually disclose at augureai.ca.