Hosting in Canada: Toronto and Montréal.
Canadian clients choose between two hosting types. Both are dedicated environments — your data, configuration, users and files are never shared with another client — and both keep every byte, including backups and support access, inside Canada.
Sovereign — Google Cloud
- Primary region Toronto; encrypted backups replicated to Montréal
- Cloud Run, Cloud SQL (PostgreSQL), Cloud Storage, Cloud Armor WAF
- Data-residency and personnel-access controls enforced by the platform, not by policy alone
- For municipalities with a sovereignty clause, enterprise security review or high volume
Standard — DigitalOcean
- Toronto data centre; backups encrypted and stored in Canada
- Same application, same isolation, same encryption and audit trail
- Lower monthly cost; the default for towns, townships and SPCA-style multi-tenant programs
- Upgrade to the sovereign tier at any time without re-implementation
Hosting in the United States: six locations.
US clients get the same two hosting types in US data centers. Primary and backup locations are chosen with you — typically the pair closest to your state — and nothing is replicated outside the country.
Sovereign — Google Cloud
- Dallas, Salt Lake City or Chicago as primary; a second US region for encrypted backups
- Cloud Run, Cloud SQL (PostgreSQL), Cloud Storage, Cloud Armor WAF
- For counties, larger cities and agencies with a security questionnaire or state residency requirement
Standard — DigitalOcean
- New York, New Jersey or San Francisco; backups encrypted and stored in the US
- Same application, isolation, encryption and audit trail as the sovereign tier
- The default for towns, villages and animal-services agencies
Data sovereignty
Sovereignty is a set of controls, not a sentence in a contract.
Five commitments apply to every Milo deployment in both countries. They are written into the subscription agreement and verifiable from your own admin console.
1 · In-country storage
Database, documents, logs and backups live in data centers inside the client's country. No cross-border replication.
2 · In-country processing
Email (Amazon SES), SMS and error tracking run from regional endpoints with data-locality settings. OfferioAI runs closed-loop inside the same environment.
3 · In-country people
Support and engineering access comes from Blü staff in Canada and the US. No offshore staff, no offshore sub-processors; the sub-processor list is published and change-notified.
4 · You own the data
The client owns all records, documents and audit history. Full export in open formats at any time; certified destruction within 30 days of exit.
5 · Lawful-access transparency
Any request from a third party or authority for client data is referred to the client unless legally prohibited, and logged.
Verified from your console
Hosting region, backup location, sub-processor list and the staff-access log are visible to your administrators, not just stated in a document.
Data-flow restrictions by market
Where each kind of data is allowed to go.
Canadian deployments are configured to respect PIPEDA, provincial public-sector privacy law (MFIPPA in Ontario, Law 25 in Québec, FOIPPA in BC) and municipal records by-laws. US deployments respect state privacy and public-records statutes, PCI DSS scope rules and, where relevant, CJIS-adjacent handling for enforcement data. The table shows the resulting rules.
| Data | Canada | United States |
|---|---|---|
| Resident records and application data | Stored and processed in Toronto / Montréal only. No transfer outside Canada, including for support. | Stored and processed in the chosen US regions only. No transfer outside the US, including for support. |
| Documents and uploads | In-country object storage; optional mirror to the client's Google Drive (Canadian Workspace tenancy). | In-country object storage; optional mirror to the client's Google Drive (US Workspace tenancy). |
| Payment card data | Never enters Milo. QuickBlu, Worldline, Moneris or Stripe hold cardholder data; Milo stores token, brand and last four digits. | Never enters Milo. QuickBlu or Stripe hold cardholder data; Milo stores token, brand and last four digits. |
| Email and SMS content | Amazon SES Canadian regions; a Canadian-locality SMS service. Delivery logs kept in-country. | Amazon SES US regions; a US-locality SMS service. Delivery logs kept in-country. |
| Enforcement and plate data | Pushed only to the enforcement vendor the client names (e.g. AutoChalk), over TLS, logged with retries. | Pushed only to the enforcement vendor the client names, over TLS, logged; handled as restricted data where state rules require. |
| AI processing (OfferioAI) | Closed-loop inside the client environment; no data sent to public models; outputs reviewed by staff. | Closed-loop inside the client environment; no data sent to public models; outputs reviewed by staff. |
| Backups | Daily, AES-256, 7-day rolling, replicated to Montréal. | Daily, AES-256, 7-day rolling, replicated to a second US region. |
| Security and audit logs | Kept in-country; exportable (JSON/CSV) to the client's SIEM; retention set by the client (default 2 yrs sign-in events, 7 yrs data changes). | Kept in-country; exportable to the client's SIEM; retention set by the client with the same defaults. |
| Public-records requests | Admin-run export of any record set for MFIPPA / access-to-information responses. | Admin-run export of any record set for FOIA and state public-records responses. |
| Support access | Blü staff in Canada, by named account, logged and visible to the client. | Blü staff in Canada or the US, by named account, logged and visible to the client; US-only support staff on request. |
Security controls
The controls behind the commitments.
Incident process
What happens in the first 24 hours, and after.
A security incident is any confirmed or reasonably suspected unauthorized access to, or loss of, client data. The process is the same in both countries; notification timing honours the stricter of our commitment and the applicable law (PIPEDA and provincial breach rules in Canada; state breach-notification statutes in the US).
A named incident lead at Blü, reachable 24/7 by phone during an open incident, plus your account manager. Updates go to the contacts you designate in the subscription agreement.
Detect and contain
Alert from monitoring, scanning, a client report or a processor. Affected systems isolated; credentials rotated; evidence preserved.
Notify the client
Written notice within 24 hours of confirming an incident affecting your data: what is known, what is affected, what we are doing.
Update until closed
Daily written updates while the incident is open; a call with your IT and privacy leads on request.
Help you meet your obligations
We supply the facts and records you need for your own notifications — to the Privacy Commissioner or provincial authority in Canada, to the state attorney general or affected residents in the US.
Post-incident report
Root cause, timeline, data affected, corrective actions and dates, delivered within 10 business days of closure.
Continuity and exit
Available when you need it. Yours when you leave.
Need this as a document for your security review?
Request the technical package — architecture, questionnaire responses, VPAT, sub-processor list and incident runbook.