Where your call data lives under Law 25

Quebec's Law 25 requires a privacy impact assessment before personal information is communicated outside Quebec. Call recordings, voicemail and call logs are personal information. If your phone system stores them in the United States (and most do), that assessment is your obligation, not your vendor's.

This is the least-discussed obligation in the statute and the one most likely to apply to you without anyone mentioning it, and it sits alongside five others that reach a Quebec business.

Before communicating personal information outside Quebec, you must assess whether it would receive adequate protection, having regard among other things to the legal framework of the destination. The assessment weighs the sensitivity of the information, the purpose, the protections in place, and the regime that applies where it is going, which a contract cannot override.

Two things follow that are worth being precise about:

• It is an assessment, not a prohibition. Storing data outside Quebec is not forbidden. Doing it without having assessed it is the failure.
• The obligation sits with you, the business collecting the information, not with the vendor. A vendor can make it easy or impossible to complete, but cannot complete it for you.

Cloud telephony is built on a small number of large platforms, and their default regions are not in Quebec. In our own review of eight competing vendors, published on 2026-08-19:

• not one of the eight names Law 25 anywhere on its site
• one states plainly that data "may be stored in the US"
• two name a Canadian region without saying whether it means residency
• several publish nothing locatable about where data physically sits

That is not a scandal: it is a market that sells mostly into the United States. But it means the question is yours to ask, and the answer is often three clicks deeper than the marketing page.

Four questions, and the shape of the answer tells you as much as its content.

"Where is my data stored?"

A good answer names a region. A poor answer says "the cloud", "globally distributed", or "in secure data centres".

"Does a Canadian region mean Canadian residency?"

These are not the same. A region can process in-country while backups, logs or support access sit elsewhere.

"What crosses the border, and when?"

Recordings might stay put while transcription, analytics or support tooling does not.

"Can you give me what I need for the assessment?"

A vendor that publishes its sub-processors, its regions and its retention makes the assessment a morning's work. A vendor that does not makes it impossible, and that is itself a finding.

Ringfully's data is in AWS us-east-1: Northern Virginia, United States. Not a Canadian region. If you are a Quebec business, communicating personal information to us is a transfer outside Quebec, and Law 25 asks you to assess it before you begin.

We would rather write that sentence than let you find it in a sub-processor table later. What we can do is make the assessment cheap: our sub-processor list is published in full with no form and no login, it names every party and what each one receives, and our privacy policy states retention in plain terms.

What we cannot do is tell you the transfer is fine. That judgement is yours, and any vendor who makes it for you has told you something about how carefully they read the statute. Everything we hold, and the gaps we still have, is on security.

A description of what the statute asks, not legal advice. Confirm your position with a Quebec-qualified adviser. Related: what Law 25 asks of a phone system.