Why Storing Member Sign-In Data on US Servers Is a Risk

A Liability That Was Never Priced Into 'Free'

A free Google Form or Microsoft Form is usually the fastest way to get a sign-in sheet online. Someone sets it up in an afternoon, shares the link, and within a week it is collecting names, phone numbers, and program details from the families, newcomers, and seniors who walk through the door. What rarely gets decided on purpose is where that information actually ends up sitting, and under whose laws. For most one-time uses that gap does not matter. For an ongoing program collecting information about children, newcomers, or people in vulnerable circumstances, it is a real liability worth naming plainly rather than assuming away.

Where the Data Actually Lands: Canada or the US

A standard, free Google account stores Google Forms responses on Google's global infrastructure, which can include data centres anywhere in the world, commonly the United States. Google does offer a Canadian data region and stronger residency controls, but those are features of paid Workspace Enterprise or Education Plus plans, not the free consumer version most nonprofits reach for first.

Microsoft Forms works similarly. Microsoft's own documentation states that tenants outside the European Union have their Forms data stored in the United States by default. A Canadian organization using a free or standard Microsoft 365 account, without a paid Advanced Data Residency add-on, should assume its form responses are stored on US servers.

What a US Server Actually Exposes You To

Both Google and Microsoft are incorporated in the United States. Under US law, a US-based company can be legally required to produce data it holds, even when that data is stored on servers outside the US, if the company itself has the technical ability to access it. The physical location of a data centre does not fully determine which country's authorities can compel access. The nationality and legal jurisdiction of the company matters just as much, sometimes more.

In practice, this is the honest answer to a question a board member or funder might reasonably ask: who else could see this information, and under what circumstances? For a generic customer survey, the answer being "a US company, subject to US law" might be acceptable. For a family centre's sign-in records, including children's names, home addresses, and household relationships, that answer is a genuine liability, not a hypothetical one, even if it never actually gets tested.

What Changes When the Data Sits on a Canadian Server

Storing data in Canada does not make an organization immune to every risk. Breaches happen regardless of geography, and a Canadian company can still be compelled to disclose information under a Canadian court order. What Canadian storage does remove is the specific, additional layer of exposure that comes from a foreign government's legal reach, and the ambiguity that comes with it.

That difference matters most in the conversations your organization actually has to have: with a board asking what happens if something goes wrong, with a funder asking how member privacy is protected, with a family asking why their information is needed at all. "Your data stays with a Canadian company, governed by Canadian law" is a complete answer. "Your data is stored by a US company, so it depends on US law in certain circumstances" is not a disqualifying answer, but it is a longer and less comfortable one to give.

What BC's PIPA Expects You to Account For

In British Columbia, the Personal Information Protection Act (PIPA) applies to most private sector organizations, including nonprofits and community organizations, not just for-profit businesses. PIPA does not prohibit sending personal information to a service provider outside BC or outside Canada. What it does require is that your organization remain accountable for that information and take reasonable steps to ensure it receives a comparable level of protection once it leaves your hands, wherever it is stored.

Rules differ by province. Alberta's equivalent privacy law goes further and requires organizations to proactively notify individuals when their information is being collected by, or transferred to, a service provider outside Canada, including how those individuals can get more information about that provider's policies. BC's PIPA does not currently impose that same explicit notice requirement, but the underlying expectation, that your organization understands and can account for where member data goes, applies everywhere in Canada in one form or another. For a fuller walk-through of how the main Canadian privacy laws apply to a community organization, see Privacy Basics for Community Organizations in Canada, and for the rules specific to children's information, see Protecting Children's Personal Information in BC Programs.

Questions to Ask Before You Keep Using a Free Form

You do not need to abandon every free tool overnight. A short, honest review will usually tell you whether your current setup is a manageable risk for now, or a liability worth changing.

• Whose account owns the form: a personal staff email, or an organizational account your board or ED can access if that staff member leaves?

• Does your privacy policy, if you have one, actually describe where sign-in data is stored, and in which country?

• Is there a written data processing or data protection agreement available for the plan you are on? Free consumer tiers usually do not offer one.

• How long are responses kept, and does anyone have a process for deleting old records, or do they simply accumulate indefinitely?

• Could the form collect less? Every optional field you remove is one less piece of sensitive information sitting on a foreign server. See What Participant Information Should You Collect? for a purpose-first way to decide.

If you are weighing whether the convenience of a free form is still worth this liability, Free Sign-In Forms Are Like a Free Puppy: Pros and Cons lays out an honest comparison, including when a free form is genuinely still the right call.