Signing Documents From Canada: Cross-Border Privacy Explained

Why cross-border data flow matters for Canadian signers

Canadian privacy law (PIPEDA, and provincial equivalents) doesn't ban sending personal information outside Canada. It does require organizations to be transparent about it and to protect the data in transit and at rest. For businesses in regulated sectors, or anyone handling client contracts, HR files, or real estate documents, knowing where an envelope's content physically lives is part of basic due diligence.

Many popular e-signature platforms process and store everything in US data centers by default, with no Canadian option at all. Others advertise

Canadian-friendly

features while still routing core storage through the US. The details are rarely spelled out clearly, which makes it hard to compare options honestly.

Where VG·Sign actually stores and processes your envelopes

VG·Sign stores and processes envelope content, the documents, signer data, and audit trail, in the Montreal region. That means the database and file storage run on Supabase hosted on AWS ca-central-1, and the application servers run on Vercel's yul1 region. Your signed contracts and the records tied to them live on infrastructure physically located in Canada.

That said, no e-signature product today is fully self-contained within one country, and we won't pretend otherwise. VG·Sign uses US-based providers for a few supporting functions:

• Transactional email delivery (notifications, signing invitations)
• SMS delivery for phone-based verification codes
• Payment processing for subscriptions

The completion email, the one sent once every party has signed, attaches the final signed PDF. That means this specific email, carrying the finished document, does cross the border through a US email provider as it's delivered to each signer's inbox. It's a narrow, well-defined hop, not a wholesale export of your document archive, but it's real and worth knowing about.

What this means in practice

If your organization's policy requires that signed documents never touch US infrastructure under any circumstances, you'll want to factor in that final completion email, since it's the one point where a copy of the finished PDF leaves Canadian systems. For most businesses, the bigger, ongoing data (drafts, audit logs, stored files, the working copy of every envelope) staying in Montreal is the meaningful protection. It's also why we describe this plainly instead of using blanket phrases like

never leaves Canada," which wouldn't be accurate for any mainstream e-signature tool that sends email or SMS notifications.

How VG·Sign proves a signature is valid

Separate from where data lives, there's the question of how you prove, months or years later, that a signed document hasn't been altered. VG·Sign generates a SHA-256 hash of the final signed PDF and keeps an append-only audit log recording each step: when the document was sent, viewed, and signed, and by whom, with timestamps and IP information.

That combination lets you demonstrate the integrity of the file independently of any particular software vendor. It's a straightforward, verifiable mechanism, not a marketing claim about unbreakable security.

Questions to ask any e-signature vendor

Before choosing a tool to sign documents from Canada, it's worth asking a few direct questions:

1. Where is the primary database and file storage physically located?
2. Which third-party providers (email, SMS, payments) are involved, and where are they based?
3. What happens, specifically, at the moment a signed document is delivered or archived?
4. How is document integrity proven after signing?

Vendors that can answer these plainly, without resorting to vague reassurances, are usually the ones being straightforward with you. If you're comparing options more broadly, our

DocuSign alternative comparison walks through how VG·Sign stacks up on storage location, pricing, and features for Canadian teams.

Choosing the right plan

Data residency is one factor, but it's usually evaluated alongside cost and feature needs. You can see current plans and what's included at each tier on the

pricing page , and browse more detail on how envelopes, templates, and audit trails work across the rest of the

VG·Sign blog .

Transparency about where data actually goes is more useful than a badge claiming total data sovereignty.

Frequently asked questions

Does VG·Sign store signed documents only in Canada?

The envelope content, including the files, signer data, and audit log, is stored and processed in the Montreal region (Supabase on AWS ca-central-1, with app servers on Vercel yul1). The completion email, which attaches the signed PDF, is delivered through a US-based email provider, so that specific delivery step crosses the border.

Is PIPEDA compliance the same as data staying in Canada?

No. PIPEDA requires transparency and safeguards when personal information is transferred outside Canada, but it doesn't require that data stay exclusively within Canadian borders. VG·Sign's approach is to keep core storage in Montreal and be clear about the limited cases, like email and SMS delivery, where US providers are involved.

Does VG·Sign use a hash chain to prove signatures are valid?

No. VG·Sign generates a SHA-256 hash of the final signed PDF and maintains an append-only audit log of each action taken during signing. This combination lets you verify document integrity without relying on a hash chain or any proprietary blockchain mechanism.

Is VG·Sign certified under SOC 2 or ISO 27001?

No. VG·Sign does not currently hold SOC 2, ISO 27001, HIPAA, or eIDAS/AES certifications. We describe our infrastructure and processes plainly rather than claiming certifications we don't have.