Canadian CRM: data residency, bilingual and tax fit

A Canadian CRM passes a residency check when you can name production, backups, support access and any subprocessor that still sees the record. As of October 2026, Dynamics 365 North America stores data in the United States or Canada, and a Canada-only datacentre needs Advanced Data Residency on every Microsoft 365 seat. Odoo Online lists Americas production in the USA and Canada, with backups in Europe and Canada that customers cannot restrict. PIPEDA allows a foreign processor if the contract, purpose limit and customer notice are in place. Quebec Law 25, since September 2023, requires a privacy impact assessment and a written agreement before personal information leaves the province.

The late block is usually the same: the pipeline is mapped, then someone asks where the records sit. Settle that on paper before CRM implementation starts, using the five checks below.

What you should be able to name before you shortlist

The Office of the Privacy Commissioner puts the operational question as "Where do we keep it?". Answer it for the tenant you would buy, not from a marketing map. Ask each vendor for five facts in writing.

1. Production country for the live customer database.
2. Backup countries, including copies kept so a country-wide outage does not wipe the system.
3. Countries from which support and product staff can open a customer record.
4. Subprocessors inside that region, and whether you can refuse one.
5. Whether you can pin the country, or only request a broader region.

As of October 2026, three products that land on the same Canadian shortlist answer those questions differently.

• Production (Dynamics 365: United States or Canada, inside the North America macro region · Odoo Online, Americas: USA and Canada (Google, OVH, Amazon) · HubSpot: AWS in the United States (Virginia and Oregon), Canada (Montreal), Australia (Sydney) or the EU (Germany). A new subscription follows the sign-up IP address)
• Copies (Dynamics 365: Microsoft may replicate data to other datacentre regions inside the same macro region, with published exceptions · Odoo Online, Americas: Europe (France and the Netherlands) and Canada (Google, OVH). At least three copies, distant enough to survive a country-wide incident. Customers cannot restrict backup locations · HubSpot: Replicated inside the regional hosting location. HubSpot also documents processing that leaves the chosen centre)
• Pin Canada (Dynamics 365: A new environment shows macro regions unless Advanced Data Residency is enabled for all Microsoft 365 seats · Odoo Online, Americas: You may request a hosting-region change, subject to availability. You cannot choose the subprocessor inside a region, and you cannot restrict backups · HubSpot: Paid Starter, Professional or Enterprise accounts can change data centre. Free tools have to upgrade first)

That comparison rests on Microsoft's macro-region geography, the Odoo privacy policy effective 24 September 2026, and HubSpot's cloud infrastructure FAQ.

Treat a shared label as a fail until a country is named for production and for every backup. HubSpot's FAQ is a useful script for the other two products as well. It asks "Where is HubSpot’s product infrastructure hosted?", "Does a particular data center meet my legal and compliance requirements?", "Will the processing of customer data happen outside the data center location?" and "How can I check my data center and where my account data is hosted?".

Assume a 40-person distributor in Montreal and 12 people who need a sales licence. If the CRM is Odoo Online in the Americas, production may be in the USA or Canada, and backups in France or the Netherlands are part of the published design. If it is Dynamics 365 with only North America selected, data resides within the United States or Canada. In both setups, personal information about a Quebec customer can leave the province. The licence invoice does not fix that. Twelve Dynamics 365 Sales Professional licences at CAD 88.20 per user per month, paid yearly, come to CAD 1,058.40 a month before applicable tax, as of October 2026 (Dynamics 365 Sales pricing, Canada).

If the score says production or backups may leave Canada, or you cannot name them, pause the shortlist. A 30-minute call is the point where those answers get turned into vendor questions and a phase order.

When North America still means the United States

Dynamics 365 and Power Platform let a customer choose a macro-region geography for where customer data is stored. Microsoft may replicate that data to other datacentre regions inside the same macro region except where it says otherwise. The North America macro region is the United States and Canada, and Microsoft's description is that data resides within the United States or Canada (macro region geography).

Without Advanced Data Residency enabled for all Microsoft 365 seats, a new Power Platform or Dynamics 365 environment shows macro regions, not individual datacentres. With that add-on on 100 percent of Microsoft 365 seats, the tenant can select a datacentre region, and Microsoft's product terms then commit to keep Dynamics 365 and Power Platform data at rest in the selected datacentre region. Microsoft states that the Advanced Data Residency SKU itself does not make a data-at-rest promise for Dynamics 365. Ask for that add-on as its own line, and have the quote show it on every Microsoft 365 seat in the tenant, including seats that will never open the CRM.

The Canada environment host for Dynamics 365 Sales, Customer Service, Field Service and Marketing is crm3.dynamics.com. Other published hosts include NAM at crm.dynamics.com and EUR at crm4.dynamics.com (datacentre regions). Treat the host name as a check you run after an admin creates the environment. The selection rule is what assigns the country. A team that wants Sales on a named Canada region, with licences and a phase plan written down, can start from a Dynamics 365 Sales implementation.

What still leaves a Canada geography

A Canada selection covers the customer content Microsoft keeps in that geography. Adjacent services follow their own notes. Microsoft's data residency documentation lists these exceptions:

• Preview or beta services typically store customer data in the United States.
• Dynamics 365 Lifecycle Services stores certain customer data, including code, metadata, data packages and support content, on servers in the United States.
• Entra ID and the content delivery network can be global.
• Dataverse table and column names are replicated globally, while the content stays in the geography.

Put Lifecycle Services, any preview feature and Entra ID in the same note as the environment region before you tell a customer the CRM is held in Canada. If an optional cognitive service will read email text or attachments, ask where that processing runs and write the answer next to the region.

Self-hosting on Azure is the path when the SaaS geography is wider than your rule. Canada Central is in Toronto, with three availability zones, paired with Canada East. Canada East is in Quebec, has no availability zones listed, and is paired with Canada Central (Azure regions list). You can use that pair when you choose the Azure region yourself. For Odoo, that means a plan that can leave Odoo Online.

Why Odoo Online fails a Canada-only backup test

Odoo's privacy policy says customer databases are hosted in the Odoo Cloud hosting region closest to the customer, and the customer can request a region change subject to availability. Customers cannot choose the subprocessor inside a region, and they cannot choose or restrict backup locations (Odoo privacy policy).

For the Americas hosting region, production is in the USA and Canada (Google, OVH, Amazon). Backups are in Europe (France and the Netherlands) and Canada (Google, OVH). Odoo keeps at least three redundant backup copies in data centres distant enough to survive a country-wide incident. A company that cannot accept a copy in France or the Netherlands will not get that restriction on Odoo Online. "Closest to the customer" can still be a Canadian production site and a European backup at the same time.

Odoo Standard is Odoo Online only. The Custom plan adds Odoo.sh and on-premise hosting, so a customer can download Enterprise and host it. Odoo.sh hosting is not included in the subscription price. The customer owns the database and can export a backup from the control panel. Odoo states "You own your data!". That ownership is what lets you place production on infrastructure you select. On Azure, the selection can be Canada Central in Toronto, paired with Canada East in Quebec. On servers you operate, you also choose the backup sites. Odoo Online does not offer that choice.

As of October 2026, the yearly Odoo Standard price is shown as USD 31.10 per user per month, with a monthly figure of USD 38.90 beside it. The discount is valid for 12 months for the initial users. Odoo Custom is shown as USD 61.00 per user per month on the yearly price, with a monthly figure of USD 76.20, and a light user at USD 8.90. The French Canada pricing page still labels Standard in US dollars, at USD 31.10 per user per month on the yearly price (Odoo pricing, Odoo pricing, French Canada). Budget the subscription in US dollars. Keep data migration and training on a separate implementation quote so the residency decision stays readable.

When you need on-premise or a cloud region you choose, scope it as an Odoo rollout you can phase, with the hosting countries written into phase one.

What PIPEDA asks when a processor is outside Canada

Hand these pages to counsel with the vendor's region sheet attached. The checklist is the public rule, applied to a CRM project. Counsel still decides how it binds your company.

PIPEDA sets rules for how private-sector organizations collect, use and disclose personal information in commercial activity across Canada, and it also covers employee personal information of federally regulated businesses (PIPEDA in brief).

Personal information includes factual or subjective information about an identifiable individual, such as name, ID numbers, opinions and intentions, including an intention to acquire goods or services. A pipeline note that a named person intends to buy is personal information on that wording. PIPEDA does not cover business contact information (an employee's name, title, business address, telephone number or email) when it is collected, used or disclosed solely to communicate with that person about their employment or profession. A card used only to email a purchasing manager about their role can sit in that carve-out. The same address, tied to a consumer sale or to notes about the person, is a different record. Ask counsel to mark which CRM fields are which before you write the customer notice.

Alberta, British Columbia and Quebec have private-sector privacy laws deemed substantially similar to PIPEDA. Organizations subject to those laws are generally exempt from PIPEDA for collection, use or disclosure that occurs inside that province. Businesses that handle personal information crossing provincial or national borders in commercial activity remain subject to PIPEDA even if they are based in a province with substantially similar legislation. A company in Vancouver whose CRM is processed in the United States is in the cross-border case.

The accountability guidance does not impose a Canada-only storage rule. When personal information is transferred to a third party for processing outside Canada, the organization should assess the risk, contract for a comparable level of protection, limit use to the contract purpose, and tell customers. The notice the OPC describes is "advising customers their information may be sent to another jurisdiction for processing, and that while in another jurisdiction it may be accessed by the courts, law enforcement and national security authorities". Put comparable protection and the purpose limit in the vendor contract. Keep the risk assessment with the organization, and send customers the notice the OPC describes. The size of the vendor is not a substitute for those steps.

What Quebec Law 25 requires before a record leaves the province

Law 25, adopted in 2021, is a separate test from the OPC steps above. Since September 2023, before communicating personal information outside Quebec, an organization must complete a privacy impact assessment (évaluation des facteurs relatifs à la vie privée). The Commission d'accès à l'information states the timing as "avant de communiquer un renseignement personnel à l’extérieur du Québec". The transfer may proceed only if the assessment shows adequate protection, and it must be covered by a written agreement.

• Transfer outside Quebec: Since September 2023, a privacy impact assessment before the communication. Proceed only with adequate protection, and cover the transfer in a written agreement
• New or rebuilt system: A privacy impact assessment for any project to acquire, develop or overhaul an information system or electronic service delivery that involves personal information
• Collection notice: Say whether the information might be communicated outside Quebec
• Portability: Since 22 September 2024, on request, provide computerized personal information collected from the person in a structured, commonly used technological format

Those four rows are from the Commission's summary of Law 25. A CRM replacement that stores personal information is a system project under the second row, even when the servers stay in Montreal. If a backup in France is part of the design, the collection notice has to be capable of saying that the information might leave Quebec. Export one contact in a structured file during the pilot so you know which fields you could hand over if that person asks, and keep the sample with the assessment. Call it a drill, and leave the request itself to the person.

The Commission can impose administrative monetary penalties on businesses of up to 2 percent of worldwide turnover or $10 million. Penal fines for a business run from $15,000 to the higher of $25 million or 4 percent of worldwide turnover for the previous financial year, and fines double on a repeat offence (sanctions for private-sector businesses). The ceilings are a reason to finish the assessment while more than one vendor is still in the running.

A foreign processor can meet the PIPEDA accountability steps and still need the Quebec assessment and the written agreement before a Montreal customer's record is communicated outside the province. Run both tests when you have Quebec personal information and any cross-border processing.

French at work, and whether the bill is in Canadian dollars

The Charter of the French language, current to 12 August 2026, says French is the official language of Quebec. Workers have a right to carry on their activities in French. Consumers have a right to be informed and served in French. Every person has a right to have enterprises doing business in Quebec communicate with them in French (Charter of the French language). For the CRM, test two things on a pilot: a rep can complete the day's work in French, and the quote and email a Quebec customer receives can go out in French. The wider Quebec software rules sit in our note on Quebec French language requirements.

In Odoo, users can add languages after the database is created, and each user can pick a language. Emails and documents are sent to that user in the selected language. Email support is available in English, French, Spanish or Dutch (Odoo language documentation). Set one pilot user to French and send a quote. You are checking your templates and product names in that language.

Currency is a short commercial check, kept separate from implementation fees. As of October 2026, Microsoft Canada lists Dynamics 365 Sales in Canadian dollars plus applicable tax, paid yearly: Sales Professional at CAD 88.20 per user per month, Sales Enterprise at CAD 142.50, and Sales Premium at CAD 203.50 (Canada price list). The United States list for those three editions, paid yearly, is USD 65.00, USD 105.00 and USD 150.00 (United States price list). Use the Canadian agreement when you want the CAD amount published on that page. Odoo's English and French Canada price pages, cited above, showed US dollars on 5 October 2026. Our target for a first usable phase is 8 to 12 weeks. Project fees for migration and training belong on a scoped quote, not in this residency check.

What Canadian product pages show about hosting

Maximizer's company page says the product was founded in 1987, claims more than 1 million users and 120,000-plus customers, and lists a presence in Canada, the United Kingdom, Australia, Hong Kong, India, Brazil, Argentina and Mexico. The page does not state a headquarters city (Maximizer company).

A founding year and a listed Canada presence do not name the database country. Put the same five questions to Maximizer that you put to Dynamics 365, Odoo and HubSpot. If production and backups are absent from the page, ask for them in the proposal.

HubSpot is the comparison many teams already pay for. Its infrastructure includes Canada (Montreal), and a new subscription is assigned a data centre from the sign-up IP address. A buyer who completes sign-up on a US network can be placed in the United States even if the head office is in Toronto. Paid Starter, Professional or Enterprise accounts can change data centre. Free tools must upgrade first. Customer data is replicated inside the regional hosting location for backup. HubSpot also says some processing can still leave the chosen data centre, including analytics and usage data transferred to the United States, support and product development access from other regions, HubSpot affiliates, and optional apps or subprocessors (HubSpot hosting FAQ). Montreal is a real region. Analytics, support access and affiliate processing can still leave it. Keep the written answer to the processing question with the contract.

How to close the check before anyone configures the pipeline

Work through this while you can still change products.

1. Write the countries you will accept for production, for backups and for support access. If Quebec personal information is in the database, mark any communication outside Quebec as an assessment item.
2. Collect the five facts from each bidder for the edition on the order form: Odoo Standard or Custom, Dynamics 365 with or without Advanced Data Residency on every Microsoft 365 seat, HubSpot on a free tool or on a paid plan that can move region.
3. Match the paper to the admin screen. For Dynamics 365, compare the selected geography with the environment host. For HubSpot, compare the sign-up path with the data centre on the account.
4. Send counsel either the foreign-processing duties or the Quebec assessment scope, with the vendor's countries attached.
5. Then lock fields, integrations and training. A French user language and a CAD invoice are fit checks. They do not relocate a backup.

When the paper fails, the next working session is on your countries and your phase order. CRM implementation for Canadian companies covers discovery, configuration, data migration, training and support after go-live, in phases, on Dynamics 365 and on Odoo. Bring the residency answers. We will order which workflows can move first and which hosting choice counsel still has to accept.

How Flectic can help

Flectic sets up Dynamics 365 Sales for sales teams of 20 to 100 people in the US and Canada that sell through long, considered cycles and need a pipeline they can forecast from. Our Dynamics 365 Sales implementation begins with a first phase that maps your sales process and data model before anything is configured. Flectic sends a written proposal with a fixed price for each phase before work starts. The next step is to book a free discovery call with Flectic.

Sources

PIPEDA requirements in brief, Office of the Privacy Commissioner of Canada, October 2026

PIPEDA Fair Information Principle 1, Accountability, Office of the Privacy Commissioner of Canada, October 2026

Principaux changements apportés par la Loi 25, Commission d'accès à l'information du Québec, October 2026

Sanctions, Commission d'accès à l'information du Québec, October 2026

Charter of the French language (C-11), LégisQuébec, October 2026

Power Platform and Dynamics 365 macro region geography, Microsoft, October 2026

Microsoft Dynamics 365 and Power Platform data residency documentation, Microsoft, October 2026

Power Platform and Dynamics 365 datacenter regions, Microsoft, October 2026

List of Azure regions, Microsoft, October 2026

Odoo Privacy Policy, Odoo, October 2026

Odoo Pricing, Odoo, October 2026

Odoo Pricing, French Canada, Odoo, October 2026

Install languages, Odoo, October 2026

HubSpot Cloud Infrastructure and Data Hosting FAQ, HubSpot, October 2026

Dynamics 365 Sales pricing (Canada), Microsoft, October 2026

Dynamics 365 Sales pricing (United States), Microsoft, October 2026

Company, Maximizer, October 2026