Sovereign data, hosted in Canada.
The application, the primary database and the primary photo storage are hosted in Beauharnois, Québec, in Canada. Database backups are kept in Canada. Some services receive information outside Canada. Here is where your data lives, the list of what leaves it and three checks you can run yourself.
- ✓ Primary hosting in Beauharnois, Québec
- ✓ No global CDN for gallery photos
- ✓ External services and destinations listed
- 1Application, primary database, photos: in Beauharnois
- 2What leaves it is named, service by service
- 3Three checks you can run yourself
Published October 16, 2026 · 7 min read
1Where your data lives
Our primary hosting is in OVHcloud’s Beauharnois region, in Québec, south-west of Montréal.
Three things are hosted there: the application servers, the primary database and the primary photo storage. We do not use a global delivery network (CDN) for gallery photos: when a parent opens a gallery, the images come from Beauharnois.
Hosting in Canada does not mean every processing activity and every copy remains there. The backup copy and the other services are detailed in section 3.
The application
The servers display your galleries, your store and your admin area. They process the information needed for these functions and use the database, the file storage and the processing queues, among other components.
The primary database
Student lists, access codes, orders and your studio’s audit log. Its backups have one copy on a company server in Canada, described below.
The primary photo storage
Originals, watermarked previews and the files to deliver. In our code, storage is locked to the Beauharnois region.
2Where the servers are does not tell you everything
Three separate questions to ask any platform, ours included.
A covered service provider subject to United States jurisdiction may have to disclose, under valid legal process, data in its possession, custody or control, even when that data is stored in Canada. This is provided by the CLOUD Act, a 2018 United States federal law. Headquarters alone do not settle that question. It also arises for the Amazon e-mail service we use in Montréal.
Our primary host, OVHcloud, belongs to a French group whose parent company, OVH Groupe SA, is based in Roubaix. We use its Beauharnois region. Hosting in Canada does not exclude lawful access requests: Canadian authorities and, through applicable procedures, foreign authorities may request information.
Where is data processed and stored?
Primary hosting is in Beauharnois, Québec, and one backup copy is on a company server in Canada. Other processing activities and recipients are described in section 3.
Who can access it?
Our team and, depending on the service, the providers named in this article.
Which laws and agreements govern that access?
The applicable laws depend in part on the provider and the processing activity. This article does not provide an inventory of contractual agreements. Ask for these three answers in writing, from us as from any platform.
3What leaves Beauharnois, and where it goes
Our store also uses external services. Here is what leaves our primary hosting in Beauharnois, service by service, where it goes and what travels, as of October 15, 2026. Some destinations are in Canada, others are not.
Payment
Stripe handles payments and some billing and payout operations. It receives payment information, which may include the parent’s name or e-mail depending on the payment method. The card number and security code are entered directly with Stripe, without passing through our servers. Every studio uses Stripe.
Diagnostics
Sentry receives error and performance diagnostics. Filters reduce the personal information transmitted. After an error, a recording of the browsing session may be sent, with text masked and media blocked. These measures do not guarantee the absence of all personal information.
We use Amazon SES, in the Montréal region. Replies sent to our support and their attachments also pass temporarily through Amazon’s storage in that region. Amazon is an American group, so the CLOUD Act described above concerns it. Depending on the message, an e-mail contains access codes, order details or a child’s name.
The fallback e-mail service
When Amazon SES limits sending or reports certain availability errors, some e-mails may go through Postmark if the fallback is configured and permitted for that message. The recipients and the message content are then sent to Postmark.
Previews in e-mail
Some e-mails display photo previews. The recipient’s e-mail service may retrieve them and keep a copy outside Canada. A watermark does not change where that copy is.
A backup copy
The automatic backups of the database are kept with OVHcloud, in Beauharnois. A backup copy is also kept on a company server in Canada. These backups contain student lists and orders, among other data, but not the photo files.
The print lab
The selected lab receives the photos and the information needed for the order. Options include a lab in Alberta and labs in Québec.
Sign-in text messages
Photographers’ sign-in codes by text message go through VoIP.ms, a provider based in Montréal. The number and the code are transmitted; the message then travels through the phone carriers’ networks.
Technical services
Issuing our security certificates involves an external DNS provider and certificate authority. Some protected previews also use an external service to obtain encryption keys and viewing permissions. This service can receive technical content identifiers and requests from the viewing software. Its processing locations remain to be confirmed. The address of a shoot location may be sent to Nominatim to obtain its coordinates. The location of our hosting provider’s cluster management service remains to be confirmed. We have not yet confirmed where the certificate authority and the Nominatim service we use process these requests.
Exports to studios and schools
Depending on the feature used, the studio can download photos and student information or send a school a portrait archive with student numbers in the file names. Lightroom synchronization can also send student names to the studio’s workstation. The location of the copies depends on the devices and services used by the recipients.
4What your school board may ask of you
The studio answers for the information it collects. Choosing a platform is part of that responsibility.
A school board may set its own rules for student information: where it may be stored, which providers may receive it, what must be agreed in writing. These rules differ from one board to the next. Ask each board you work with for its requirements in writing, then compare them with the list in section 3.
What it does not mean
Hosting in Canada alone does not show that a school board’s requirements are met. Using a provider outside Canada alone does not show the opposite either.
What it changes for you
For your answer to a school board, identify each recipient outside Canada, each provider that belongs to a foreign group, and the information each one receives. The list in section 3 helps you identify them.
What we give you
Where our hosting is and the list of what leaves it, as they appear here, with the points that remain to be confirmed. This article is not legal advice.
5The journey of a photo
A photo does not follow a single path. Here are its branches.
Photos are uploaded to Beauharnois. Depending on their use, they are then shown in the parent’s gallery, delivered as a digital file, shown as a preview in an e-mail or sent to the selected lab. Copies may end up outside Canada depending on the recipient or the e-mail service.
The parent’s gallery
From Beauharnois to the parent’s device.
The delivered digital file
Once downloaded, the copy follows the parent.
The preview in an e-mail
The recipient’s e-mail service may keep a copy.
The selected lab
The lab the studio chooses receives the photos to print (section 3).
6Check for yourself
Do not take our word for it. Three checks, valid for any platform. The first two give clues; the third gives answers.
The address of an image
With MaplePhoto, you will read an OVHcloud domain containing “bhs”, for Beauharnois, or the gallery’s own address, which ends in galleries.photo. It is a clue about the address used for that image. It does not prove the location of every copy, backup or processing activity. Do not share the complete address: it may contain temporary access to the photo.
- Open one of the platform’s galleries on a computer.
- Right-click a photo, then choose “Copy image address”, if the option is offered.
- Paste the address into a document and read the domain name that follows “https://”.
The address of the platform
A DNS and network lookup can identify the network associated with the public address: the host, or an intermediary placed in front of it. It cannot establish where the database, the photos or the backups are stored.
- Note the domain name of the platform’s website, or of one of its galleries.
- Look up its address: in a terminal, type nslookup followed by that domain name (for example, nslookup maplephoto.ca), or enter only the domain name in a public DNS lookup tool, without a gallery code or a private link.
- Enter the address it returns in a network lookup (WHOIS) tool, then read the network name and the name of the company that holds it.
The written request
A dated written answer documents the provider’s commitments. It is not an independent audit, but it is the only one of the three checks that covers what cannot be seen from outside.
- Ask where the application runs and where database information, photos, backups, e-mail and diagnostics are processed and stored.
- Ask which companies and teams can access them, and from which countries.
- Ask for the available information on the privacy impact assessments and the agreements that apply.
7Questions to ask your platform
Compare written answers covering the same data and the same services. Here are ours.
| The question | MaplePhoto | Your current platform |
|---|---|---|
| Where does the application run? | The application servers are hosted with OVHcloud in Beauharnois, Québec, in Canada. | |
| Where is the primary database? | In Beauharnois, Québec. | |
| Where are the photos stored? | The primary photo storage is in Beauharnois. Delivery to recipients may create copies elsewhere. | |
| Where are the backups? | With OVHcloud, in Beauharnois. A backup copy of the database is also kept on a company server in Canada. | |
| Does a global network (CDN) deliver the gallery photos? | No. Gallery photos are served from Beauharnois. | |
| Which services process payments, and where? | Stripe only, for every studio: United States and other countries. | |
| Which services carry the e-mail? | Amazon SES, in the Montréal region; Amazon is an American group. A fallback service, Postmark, in the United States, can carry some messages when it is enabled. | |
| Can e-mail create copies outside Canada? | Yes. The recipient’s e-mail service may keep the message and retrieve photo previews outside Canada. | |
| Where do error diagnostics go? | To Sentry, in the United States. Filters, text masking and media blocking reduce the information transmitted. | |
| Where do print orders go? | To the lab the studio chooses. Options include a lab in Alberta and labs in Québec. | |
| Who is the host’s parent company? | OVH Groupe SA, based in Roubaix, France. That fact alone does not determine every applicable law. | |
| What remains to be confirmed? | The location of our hosting provider’s cluster management service and the processing locations of technical services not specified here. | |
| Not offered for now | An e-mail service without an American provider. Error diagnostics hosted in Canada. | |
8Answers before you start
Is everything hosted in Canada?
No. The application, the primary database and the primary photo storage are hosted in Beauharnois, Québec, and the database backups are kept in Canada. Payment and diagnostics go through providers in the United States, and e-mail through an American group’s service in Montréal, each one named in this article.
OVHcloud belongs to a French group. What does that change?
Our primary host is not an American company. That fact alone does not settle every question of jurisdiction: hosting in Canada does not exclude lawful access requests, whether they come from Canadian authorities or, through applicable procedures, from foreign authorities.
My school asks where the photos are hosted. What do I answer?
The primary photo storage is in Beauharnois, Québec, in Canada, with OVHcloud. Send the school this article: where we host, the list of what leaves it and the points to confirm are all in it.
Is being hosted in Canada enough to meet my school board’s requirements?
Not on its own. A school board may set its own rules on where student information is kept and who may receive it. Ask yours for its requirements in writing and compare them with the list in this article. This article is not legal advice.
How do I know this list is still accurate?
This list describes our hosting as of October 15, 2026. Write to us for a dated answer.
Preparing your next season?
Ask us for the details of our hosting, or join the waitlist. Your student lists and photos use our primary hosting in Beauharnois, Québec, with the copies and disclosures described in this article. MaplePhoto is a division of Fk7 Photographie Inc., a Canadian company.