Upper Harbour

Upper Harbour is a Canadian technology company focused on data sovereignty and privacy compliance. Rather than selling conventional enterprise software, it positions itself as a research and intelligence provider that maps how Canadian organizations depend on software controlled by foreign companies, governed by foreign laws, and subject to foreign data-access regimes. Its public-facing work is organized around the Canadian Technology Sovereignty Index, a dataset that maps tools to their parent jurisdictions, ownership structures, and exposure to the United States CLOUD Act. The company's core argument is that data residency and data sovereignty are different questions. In Upper Harbour's framing, data residency is a server configuration, while data sovereignty is a legal and corporate structure question. Its dataset reports that a large share of tools offering Canadian hosting remain CLOUD Act exposed because their parent companies are US-controlled. The company presents this as a layer-by-layer problem: applications, platforms, infrastructure, and hardware and data centres each carry independent jurisdiction risk, and the legal jurisdiction governing data often sits one layer above the infrastructure where sovereignty debates usually focus. Upper Harbour's public offering includes a Sovereignty Stack framework, a Research Sovereignty Index, a Signals product, and a Compliance Map. It invites organizations to check their own software stack for free and to explore the underlying research. The company has been described by BetaKit as one of Canada's most ambitious companies, according to a 2026 reference on its homepage. Upper Harbour operates in the Canadian market and addresses buyers concerned with public-sector procurement, regulated-industry compliance, and technology supply-chain risk. Its materials cite external testimony, including a statement attributed to Anton Carniaux of Microsoft France before the French Senate in June 2025, to illustrate that a legally valid US CLOUD Act order can compel compliance regardless of where data is stored. The company's positioning is therefore as an independent Canadian voice on technology sovereignty, combining research, indexing, and compliance-oriented tooling rather than traditional software licensing.

Upper Harbour is a Canadian technology company focused on data sovereignty and privacy compliance. Its public identity is built around research rather than a conventional software product line. The company operates the Canadian Technology Sovereignty Index, a dataset that maps tools to parent jurisdictions, ownership structures, and CLOUD Act exposure. According to its homepage, the index covers 780 tools and is used to show how Canadian organizations rely on software controlled by foreign companies, governed by foreign laws, and subject to foreign data-access regimes. The company's central analytical claim is that data residency and data sovereignty are distinct. It states that data residency is a server configuration, while data sovereignty is a legal and corporate structure question. In its dataset, it reports that 80% of tools offering Canadian hosting remain CLOUD Act exposed because their parent companies are US-controlled. This finding underpins its Sovereignty Stack framework, which separates applications, platforms, infrastructure, and hardware and data centres into layers with independent jurisdiction risk. Upper Harbour argues that sovereignty debates often focus on infrastructure, while the legal jurisdiction governing data frequently sits one layer up, in the software organizations use daily. Upper Harbour's public materials include a Research Sovereignty Index, a Signals product, and a Compliance Map. It offers a free stack check and invites users to explore the research. The homepage cites BetaKit's 2026 description of Upper Harbour as one of Canada's most ambitious companies. It also cites testimony attributed to Anton Carniaux of Microsoft France before the French Senate in June 2025, stating that if a legally valid US CLOUD Act order is issued, Microsoft is obligated to comply regardless of where data is stored. Upper Harbour uses this to reinforce its argument that Canadian data residency does not equal Canadian data sovereignty. The company operates in Canada and addresses organizations concerned with public-sector procurement, regulated-industry compliance, and technology supply-chain risk. Its work sits at the intersection of research, compliance tooling, and technology policy. No founding date, founder, headquarters location, ownership structure, or executive team is provided in the available evidence.

• BetaKit describes Upper Harbour as one of Canada's most ambitious companies (as cited on the company's homepage in 2026).

• Upper Harbour's homepage cites June 2025 French Senate testimony by Anton Carniaux of Microsoft France on CLOUD Act obligations.

Independent Canadian research and intelligence on technology dependency and data sovereignty, arguing that data residency does not equal data sovereignty.

• Canadian Technology Sovereignty Index

  A dataset mapping 780 tools to parent jurisdictions, ownership structures, and CLOUD Act exposure.

• Sovereignty Stack

  A layered framework separating applications, platforms, infrastructure, and hardware and data centres by jurisdiction risk.

• Research Sovereignty Index

  A research index referenced on the company's homepage.

• Signals

  A product referenced on the company's homepage.

• Compliance Map

  A compliance-oriented mapping product referenced on the company's homepage.

1. 1Upper Harbour — Canadian Technology Sovereignty Intelligenceupperharbour.ca
2. 2Upper Harbourwikidata.org