Read summarized version with
About project
Working time:
2025
Industry:
Benefits software
The service:
Cloud Security
Overview
The customer is a Canadian software company whose benefits administration platform is used by insurers, public-sector employers and their members. New public-sector contracts required proof that member data stays in Canada.
The Challenge
The platform already ran in the AWS Canada (Central) Region, but hosting in a Canadian Region is not the same as a residency design, and procurement wanted proof.
1. No Guardrails
Nothing stopped a team from enabling a service in another Region.
2. Default Destinations
Some logs and backup copies went to default destinations outside Canada.
3. Keys Without a Plan
Encryption keys were created project by project with no residency rules.
4. No Evidence
Answers to privacy and procurement questionnaires were assembled by hand for each bid.
Technology & Approach
We wrote down what had to stay in Canada, then built a landing zone where that is enforced by guardrails and shown by evidence.
Implementation
Phase 1: Residency Design
Documented which data, keys, logs and backups must stay in Canada, which AWS services fit, and how global services such as IAM and Amazon Route 53 are handled.
Phase 2: Landing Zone Build
Set up AWS Control Tower with Region-deny controls and service control policies, separate accounts for workloads, logs and security, in-Region AWS KMS keys, AWS CloudTrail and AWS Config logs in Canada, and AWS Backup copies in the Canada West (Calgary) Region.
Phase 3: Workload Move
Moved the production and test workloads into the new accounts with infrastructure as code.
Phase 4: Evidence Pack
Added detective controls for residency drift and an evidence pack with the design, policies and queries that show where data lives.
Customization & Client Adaptation
The landing zone was designed for the questions public-sector buyers actually ask.
Two Canadian Regions
Workloads run in Canada (Central) with backups and recovery in Canada West (Calgary), so resilience never requires leaving Canada.
Global Services Handled Openly
The design lists each global service in use, what data it touches and why it is acceptable.
Evidence on Demand
Residency queries run against AWS Config and AWS CloudTrail data, so procurement answers come from the record.
Access You Can Approve
Operator access runs through roles the customer controls, with every action logged.
If you find this case interesting, we recommend taking a closer look at
The Results
The provider answered its next public-sector procurement with a residency evidence pack instead of a hand-written questionnaire, and no service can now be enabled outside the two Canadian Regions.
Long-Term Value
- A foundation new workloads join without repeating residency work.
- Guardrails that hold as the team grows.
- Evidence that stays current between bids.
Business Impact
- Residency is shown, not just promised.
- Faster security and privacy reviews in sales cycles.
- Backups and recovery stay inside Canada.
