What does data sovereignty mean for an IoT deployment and why does it matter?
Data sovereignty means that device telemetry, identity records, command history, and audit trails reside in a specific legal jurisdiction and are subject to its laws — not the laws of the jurisdiction where your cloud provider's servers happen to be located. It matters because Canadian privacy law (Law 25 in Québec, PIPEDA federally), government procurement policy, and regulated-industry requirements increasingly mandate that data not leave the country. Fundamentum deploys on Canadian sovereign cloud infrastructure by default for Canadian clients, meeting these requirements without custom architecture.
What is Québec Law 25 and what does it require from an IoT platform?
Law 25 (formerly Bill 64) is Québec's privacy legislation, substantially aligned with GDPR. It requires that personal information — including device telemetry that can be linked to an individual — be stored and processed in Québec or in a jurisdiction with equivalent privacy protections, with explicit consent and documented data governance. For an IoT platform, it means: data residency in Québec or Canada, documented access controls, an audit trail of who accessed what data and when, and the ability to respond to data subject access requests. Fundamentum's Canadian sovereign deployment, RBAC audit trail, and immutable action records satisfy all four requirements operationally.
What does Canadian data residency mean in practice for an IoT platform?
It means that device telemetry, identity records, configuration data, firmware artifacts, and audit logs are stored on servers physically located in Canada, operated by entities subject to Canadian law, and not accessible by foreign governments through instruments like the US CLOUD Act. Fundamentum's sovereign deployment uses Canadian cloud infrastructure. Data does not cross the border as part of normal platform operation. For enterprise and government clients with explicit data residency requirements, this is confirmed in writing in the engagement agreement.
Can we use AWS or Azure and still meet Canadian data sovereignty requirements?
Partially. AWS and Azure both offer Canadian regions (ca-central-1, Canada Central) where data is stored on Canadian soil. However, both companies are US-headquartered, which means US law — including the CLOUD Act — potentially applies to data held by their Canadian subsidiaries. For some clients, Canadian-region hyperscaler deployment is sufficient. For government and defence procurement, or for clients with explicit sovereignty requirements, a Canadian-headquartered operator is required. Fundamentum is operated by Amotus, a Canadian company under Vectanor Group, providing sovereignty assurance that hyperscaler Canadian regions cannot offer.
What is the difference between data residency and data sovereignty?
Data residency means the data is physically stored in a specific location. Data sovereignty means the data is subject to the laws of a specific jurisdiction — and critically, is protected from foreign legal instruments. A Canadian-region AWS bucket satisfies data residency. It does not fully satisfy data sovereignty because the operator (AWS) is subject to US law. Fundamentum satisfies both: data resides in Canada and is operated by a Canadian entity not subject to US jurisdiction over that data.
What does PIPEDA require from an IoT platform managing connected devices in Canada?
PIPEDA (Personal Information Protection and Electronic Documents Act) requires that personal information collected by IoT devices be collected with knowledge and consent, used only for the purpose for which it was collected, protected by appropriate security safeguards, and subject to individual access and correction rights. For Fundamentum, this means: the RBAC model ensures data access is limited to authorized roles, the audit trail documents every access event, data residency in Canada prevents cross-border transfer without consent, and the Device Registry's identity lifecycle management ensures decommissioned devices stop transmitting. These are operational properties of the platform, not compliance add-ons.
What does IoT sovereignty mean for government and defence procurement in Canada?
Canadian government and defence procurement (DND, PSPC, CSE-aligned programs) requires that sensitive data be processed on Canadian soil by Canadian entities, that foreign governments cannot compel disclosure of the data, and that the supply chain is auditable. Fundamentum's sovereign deployment meets the data residency and operator nationality requirements. The Stratys consortium, of which Amotus is a member, is specifically positioned for Canadian defence and public safety IoT deployments, providing the supply chain and operational context that DND and PSPC procurement requires.
Can Fundamentum be deployed in a private cloud or on-premises for maximum sovereignty?
Fundamentum's architecture — built on Kubernetes with standard containerized microservices — is designed for sovereign deployment flexibility. The platform can be deployed on Canadian sovereign cloud infrastructure, in a client's private cloud environment, or in a hybrid model where specific data categories remain on-premises while governance operations run in the sovereign cloud. The deployment model is defined during the Phase Zero architecture review and confirmed in the engagement agreement. Amotus has executed sovereign cloud deployments for clients with specific data residency requirements outside the standard cloud model.
What happens to our device data if our IoT platform provider is acquired by a foreign company?
This is a material risk that most teams do not evaluate at contract time. If a foreign-headquartered company acquires your IoT platform provider, your device data — including telemetry, identity records, and audit trails — may become subject to foreign law. Fundamentum is operated by Amotus, a division of the Vectanor Group, a Canadian-headquartered organization. The enterprise engagement agreement includes data portability provisions that ensure your data remains accessible regardless of corporate events. Evaluating this risk explicitly — and requiring contractual protections — is a standard component of Amotus's Phase Zero due diligence.
How do we demonstrate data sovereignty compliance to our own enterprise clients and regulators?
Fundamentum provides the operational artifacts that make sovereignty auditable: the immutable audit trail documents every access event with timestamp, actor identity, and action taken; the RBAC model documents who is authorized to access which data; the deployment architecture documentation confirms data residency in Canada; and the SOC 2 Type II report confirms that these controls operated correctly over the audit period. For regulated industries — healthcare, energy, government — these artifacts are typically sufficient to satisfy a regulator's or enterprise client's data governance review.
What is the CLOUD Act and why does it matter for Canadian IoT deployments?
The Clarifying Lawful Overseas Use of Data Act allows US law enforcement to compel US-headquartered companies to produce data stored on their servers, regardless of where that data is physically located. This means a Canadian-region AWS or Azure deployment may still be subject to US government data requests. For Canadian government, healthcare, and enterprise clients with sovereignty requirements, this is a material risk. Fundamentum is operated by Amotus, a Canadian company not subject to the CLOUD Act, providing a legal sovereignty guarantee that US-headquartered hyperscaler deployments cannot.
Can Fundamentum support a multi-jurisdiction deployment where data from different countries stays in those countries?
Fundamentum's multi-region architecture supports jurisdiction-specific data residency: devices in Canada route telemetry to the Canadian deployment, devices in Europe route to a European deployment, and the two datasets do not comingle. The RBAC model and Device Registry are consistent across regions — the governance model is unified — but the data plane is jurisdiction-specific. This architecture is relevant for organizations operating IoT fleets across multiple regulatory environments simultaneously, and is available to enterprise clients under the multi-region deployment option.
What is the difference between a sovereign IoT platform and a GDPR-compliant one?
GDPR compliance means meeting the European Union's data protection requirements: lawful basis for processing, data minimization, subject access rights, breach notification. Sovereignty means the data is under the exclusive legal jurisdiction of a specific nation-state, protected from foreign legal instruments. A platform can be GDPR-compliant without being sovereign (a US company's EU-region deployment), and sovereign without being fully GDPR-compliant (a national government system with no data subject rights). Fundamentum's Canadian sovereign deployment addresses sovereignty. GDPR applicability depends on whether your devices collect data about EU residents — if they do, the RBAC audit trail, data residency model, and access control infrastructure provide the technical foundation for GDPR compliance, but the legal assessment is client-specific.
How do we migrate from AWS IoT to a sovereign IoT platform without disrupting our fleet?
The migration sequence from Amotus's Phase Zero Architecture Decision Record: assess the current architecture for sovereignty gaps (which data currently crosses borders, which components are US-operator-controlled), define the sovereignty boundary for the new deployment, execute device re-provisioning in parallel with the existing fleet (Amotus has completed sovereign migrations in weeks for existing fleets), migrate telemetry ingestion and storage first (highest sovereignty value), then governance controls, then decommission the AWS dependency. The migration is designed to be reversible at each stage, with no single cutover moment that risks fleet disruption.
What questions should we ask an IoT platform vendor about sovereignty before signing?
Ask five questions and require written answers: Where is data physically stored and in which legal jurisdiction? Is the operating company headquartered in Canada or subject to foreign law? Does the CLOUD Act or equivalent foreign instrument apply to data held on this platform? What happens to our data if you are acquired? Can you confirm data residency in writing in the contract? Fundamentum answers all five affirmatively: Canadian sovereign deployment, Canadian operator, no CLOUD Act exposure, data portability provisions in the enterprise agreement, and written data residency confirmation as a standard contract term.