Two years and change separate Infobip's Canadian data residency announcement from Zoho's. Zoho opened new physical facilities in Toronto and Montreal in November 2023, its thirteenth and fourteenth data centers worldwide, aimed at large enterprises in government, banking, and financial services (Business Wire, 2023). ManageEngine, Zoho Corporation's IT management division, had already opened its own Toronto and Montreal centers in January 2023. Infobip enabled data residency and compliance support on July 29, 2026, by leveraging infrastructure it already operates inside Canada, rather than standing up a new facility. It joins a queue that already includes Cohesity, which hosted its backup service in AWS Canada Central back in 2021, and every major hyperscaler operating in the country.

Zoho Got to Canada Two Years Earlier

Marcelo Frizzo, Infobip's vice president of strategic accounts for North America, framed the move around rising concern over artificial intelligence, mobile fraud, and cybersecurity threats. Zoho, ManageEngine, and Cohesity used similar language when they made the same move in 2021 and 2023. The pattern is consistent across the industry: residency announcements target regulated private buyers first.

Twilio's position is the outlier worth noting. Its data residency program for SendGrid email covers the European Union only, as of this writing, and the company says it is evaluating expansion to other regions based on demand and feasibility (Twilio, 2026). Infobip has moved on Canada ahead of a company several times its size in the communications platform as a service market.

Context helps explain the sequencing. Infobip's Rich Communication Services traffic in the United States grew 169.3 percent between the first half of 2025 and the first half of 2026 (Intelligent CIO North America, 2026), part of a broader North American push. Regulated private industry, the finance and healthcare sectors Frizzo names, offers a shorter sales cycle than a federal contract. A documented residency requirement already sits in most vendor questionnaires at a bank or hospital system. A Canadian Centre for Cyber Security assessment is a multi-year investment vendors make once residency alone has proven the market. Zoho followed that order in Canada. Cohesity did too.

The Law Underneath Is Still Moving

The Personal Information Protection and Electronic Documents Act has governed Canadian private sector data handling for more than two decades. Ottawa tabled Bill C-36 in June 2026 to replace much of it, creating a new regulator with stronger enforcement powers under a proposed Protecting Privacy and Consumer Data Act (CXM.world, 2026). The bill has had first reading only, so PIPEDA remains in force for now. Businesses also answer to Quebec's Law 25 and provincial statutes like British Columbia's FIPPA and Alberta's Protection of Privacy Act, each with its own residency and disclosure requirements layered on top of the federal baseline.

Infobip enabled residency on infrastructure built for the regulatory regime that exists today.

Residency Answers Where. Sovereignty Asks Who Controls Access.

This distinction has come up on this site before, applied to Mistral's build-out on Microsoft's infrastructure and to Red Hat's sovereign landing zones. It holds here too. Canada's own Treasury Board draws the line: data residency is the physical location of information, while data sovereignty is Canada's right to control access to that information under Canadian law alone. A data center inside Canadian borders settles the first question. It leaves the second to whichever country's courts can reach the company operating it.

The version of that question raised most often is the United States CLOUD Act, which lets American authorities compel data held by American companies regardless of where the servers sit. Infobip is Croatian-incorporated, which sidesteps CLOUD Act exposure and opens a parallel question about reach under Croatian and European Union law, a question the announcement coverage has not yet addressed either way.

Federal Procurement Runs a Separate Track

Federal Protected B data carries a codified residency requirement. Section 4.4 of the Government of Canada's Guideline on Service and Digital sets Canadian residency as the principal delivery option, with the department's chief information officer approving any exception (Statistics Canada, 2022). Residency is the entry point, not the finish line. Cloud providers seeking Protected B eligibility go through the Canadian Centre for Cyber Security's IT Security Assessment Process against the Medium Cloud Security Profile, known before 2025 as the Protected B, Medium Integrity, Medium Availability standard. As of September 2025, AWS had 162 services and features assessed under that process in its Canada Central and Canada West regions (AWS, 2025). That assessment is the step a vendor completes before a government department can put Protected B workloads on its platform.

Infobip has not announced entry into that certification process. Frizzo's quote names finance and healthcare as the target sectors, which places this announcement inside the private-sector compliance track rather than the federal one. The scope reads as deliberate: Infobip is meeting PIPEDA, Quebec's Consumer Privacy Protection Act, and provincial freedom of information statutes, the requirements that govern its named buyers today.

Whether that scope widens is a separate question from whether today's announcement succeeds on its own terms. Canadian Centre for Cyber Security certification and a Shared Services Canada framework agreement are the two steps that open federal procurement, and they sit outside what a residency announcement covers by design.

What Happens Next

Three developments would change how this reads in a year. Bill C-36 clearing committee and reaching royal assent would tell Infobip and every peer in this market whether their current architecture needs rework. A move by Infobip into the Canadian Centre for Cyber Security assessment process would signal federal eligibility joining private-sector compliance as a goal. Somewhere further out, a regulatory or contractual test case could clarify how Croatian incorporation plays against Canadian sovereignty expectations, the way the CLOUD Act has for American vendors.