Policy Document · Cloud Commons Canada
Every time a Canadian uses an app, searches online, or moves through the world with a phone in their pocket, they generate data that is collected, analyzed, and monetized, mostly by a small number of large corporations operating outside Canada, under foreign law, with no obligation to share what they know, what they take, or what it's worth. Most Canadians can't see this happening. We're building the instrument to change that.
The Response
Canada has a data sovereignty problem. The tools to understand it, let alone govern it, don't exist. Cloud Commons Canada is building them.
The Competition Bureau, the Office of the Privacy Commissioner, and Innovation, Science and Economic Development Canada are all working in this space, and all working in the dark. The most granular data on how Canadian personal data moves comes from the corporations doing the collecting. There is no independent, participatory, ground-up evidence base.
Cloud Commons Canada is a Canadian non-profit building that evidence base. Our first tool is LEON (Local Environment Observability Node), a plain-language report for individual Canadians: which apps they use, who ultimately owns them, where their data lives, and what jurisdiction it falls under. With consent, those individual reports aggregate into a national picture. Better individual visibility, accumulated with consent, becomes the evidence base for better law.
The Problem
The visibility problem has three layers. They compound each other. Each one alone would justify action. Together, they make the case clearly.
Component 1 · Individual Visibility
Apps and digital services collect more than most people realize. Beyond what you search or type, they record device signals, location patterns, and behavioural data that flows to developers, advertisers, and cloud infrastructure. The terms of service that supposedly govern this are written to minimize comprehension, not enable it. Individual digital exposure is effectively invisible to the individual it concerns.
Component 2 · Policy Evidence Gap
Canadian institutions trying to address platform concentration, data sovereignty, and privacy reform are doing so without ground-level empirical data. The most detailed picture of how Canadian personal data moves is held by the corporations doing the collecting: corporations with a material interest in that picture remaining opaque, No independent, participatory instrument exists to generate the evidence base that policy reform requires.
Component 3 · Sovereignty Acceleration
Post-2025 policy shifts, particularly the change in posture of US-based cloud providers toward Canadian government and institutional clients, have turned what was a procurement question into a sovereignty question. Canadian reliance on foreign-owned infrastructure for storing and processing sensitive data is no longer just a privacy concern. It is an economic and national security concern. The urgency has increased. The measurement gap has not closed.
The Solution
The solution to all three problems is the same architecture: a tool that generates individual visibility, aggregates it with consent, and publishes the national result openly. Four parts work together.
Instrument · LEON
LEON (Local Environment Observability Node) gives Canadians a plain-language picture of their digital exposure: who owns the apps they use, where their data lives, what jurisdiction it falls under, and what their actual portability rights are. A structured lookup tool backed by a manually curated database. Auditable. Credible. Privacy-safe.
Architecture · The Ethical Pipeline
LEON is phase one of a four-phase ethical data pipeline: Observe (surface the system), Model (aggregate with consent), Return (value flows back to participants), Govern (publish openly). Each phase is governed by consent, obfuscation, and open publication. The pipeline is not a single app. It is the institutional architecture that converts participation into public-interest intelligence.
Output · The National Map
Aggregated across thousands of participants, anonymized structural profiles become a structural intelligence layer: concentration scores, jurisdiction risk patterns, portability gaps. Published openly, with no paywall or embargo. Available to researchers, journalists, and policymakers who currently have nothing like it.
Governance · The Non-Profit Structure
Cloud Commons Canada is incorporated under the Canada Not-for-profit Corporations Act with a dissolution clause that permanently prevents assets from transferring to private interests. No advertising. No data sales. The commons infrastructure, if it ceases to operate, goes to other commons institutions. The structural commitments are filed, public, and not changeable by board vote alone.
Policy Context
Canada is in the middle of a live policy debate about data sovereignty, privacy reform, and digital infrastructure. CCC generates the measurement layer that debate currently lacks.
Bill C-27, Canada's proposed successor to PIPEDA, would modernize Canadian privacy law, but the reform debate is proceeding without a ground-level picture of what Canadian digital infrastructure actually looks like. Who owns the apps Canadians use? Where does that data go? What does jurisdiction risk look like for a given demographic, region, or sector? None of these questions can currently be answered from independent, participatory data.
The Canadian government's SHIELD initiative (a program aimed at reducing federal reliance on foreign-owned digital infrastructure) and related work by the Treasury Board, PCO, and economic sovereignty-focused institutions have identified foreign cloud concentration as a strategic risk. CCC's measurement methodology is designed to produce the kind of structured, citable, publicly available data that these institutions can use in policy development, without depending on proprietary corporate data or expensive bespoke research contracts.
Beyond policy, there is a public interest argument: Canadians deserve to understand the system they are inside. Digital literacy is not just a matter of knowing how to use apps safely. It requires understanding the structural context in which those apps operate: who owns them, who ultimately benefits from the data they collect, and what the alternatives look like. LEON is a tool for that literacy at the individual level. The national map is the civic infrastructure version of it.
Reform Alignment
Canada's privacy reform agenda requires empirical grounding. CCC's methodology produces the kind of structured, participatory, independently gathered data that reform debates currently lack and that regulators are positioned to use.
Sovereignty Context
The shift in posture of US-owned cloud infrastructure toward Canadian institutional clients has elevated this from a procurement concern to a strategic one. CCC measures the app-layer dimension of this risk, the dimension closest to individual Canadians.
Institutional Relevance
Three federal institutions are active in the space CCC operates in. None have access to ground-up, participatory measurement data. CCC's open-access publication policy means findings are available to all of them, and to civil society, researchers, and journalists, without licensing fees.
Research Independence
The most detailed existing data on how Canadian personal data moves comes from corporate privacy reports, lobbying disclosures, and academic studies using proprietary APIs, all of which are filtered through institutions with commercial interests in the outcome. CCC has no such interest.
Phase One Outputs
Phase one has a defined, achievable scope. These are the specific outputs: not aspirations, not roadmap promises, but what the LEON instrument is designed to produce.
Individual Exposure Reports
A plain-language report for each participating Canadian: which apps they use, who ultimately owns them, where the data likely lives, what jurisdiction it falls under, and what portability rights exist. Delivered at no cost. No account required. Available to every Canadian who participates.
Structured App Database
A manually curated, publicly accessible database of apps cross-referenced against ownership, server location, legal jurisdiction, third-party SDK connections, and portability status. Updated on an ongoing basis. Auditable by any researcher or journalist who wants to verify a claim.
Anonymized National Profile
An aggregate structural intelligence layer built from opt-in participant contributions: concentration scores, jurisdiction risk patterns across the Canadian app ecosystem, portability gaps by sector. Published openly, without paywall or embargo, as a citable public-interest data product.
Annual National Report
A yearly synthesis of the structural findings: how Canada's app-layer infrastructure changed, what the concentration and jurisdiction risk picture looks like, and what the policy implications are. Designed for use by researchers, journalists, and policy institutions.
Open Methodology
The full methodology (how apps are categorized, how ownership is traced, how jurisdiction is determined, how aggregation is performed) is published openly. Other researchers can verify, replicate, or build on the approach. Transparency is not a feature; it is the design.
Long-Term Direction
Phase one is conservative and defined. The long-term aim is considerably larger, but it grows from the same foundation.
LEON is phase one of a longer-term architecture. Subsequent phases extend the methodology: deeper ownership tracing across corporate holding structures, tracking how the Canadian app ecosystem changes year over year, sector-specific analysis for health, finance, and education, and comparative work with equivalent institutions in other countries.
The long-term aspiration is a permanent, independent civic observatory: an institution that provides the ground-truth measurement layer for Canadian digital policy, the way Statistics Canada provides the ground-truth measurement layer for economic policy. That institution does not exist. CCC is building toward it, starting with the tools that make individual Canadians visible to themselves.
Phase one is scoped conservatively. The goal is credibility first: a small number of well-executed outputs that establish the methodology, demonstrate the consent model, and produce findings that can be independently verified. From that foundation, the scope expands.
We're happy to discuss the methodology, the governance structure, and the policy alignment in detail. The full corporate record is available on request. We respond to everything.