Five dimensions that matter for every Canadian business in 2026, applied across seven vendors.
| Dimension | Sovereign | Hybrid | Frontier | ChatGPT Enterprise | M365 Copilot | Azure OpenAI | Gemini Workspace | Mistral Cloud | Cohere |
|---|---|---|---|---|---|---|---|---|---|
| No outbound calls | Yes | Opt-in only | All queries | No | No | No | No | No | No |
| Out of CLOUD Act reach | Yes | Local yes, Frontier no | Frontier only — United States | United States | United States | United States | United States | Outside United States | Outside United States |
| Simplified PIA (≤ 3 pages) | 1 page | 3 pages | 3 pages | ≥ 12 pages | ≥ 12 pages | ≥ 12 pages | ≥ 12 pages | 5–7 pages | 5–7 pages |
| Audit log under your control | Local audit log | Local audit log | tonia proxy | OpenAI logs | Microsoft logs | Microsoft logs | Google logs | Mistral logs | Cohere logs |
| Terms modifiable on notice | No (firm purchase) | Local no, Frontier yes | Yes (30 days) | Yes (30 days) | Yes (Microsoft) | Yes (Microsoft) | Yes (Google) | GDPR-constrained | Canadian-constrained |
| Default retention window | 0 days | 0 days (local) / opt-in (Frontier) | 24 h contractual pause | 30 days | M365 retention policy | Microsoft policy | Google policy | 90 days | Cohere policy |
| Canadian French console | Yes | Yes | Yes | FR (France) | FR (France) | FR (France) | FR (France) | FR (France) | EN-first |
| Canadian grants applicable | CDAEIA, RS&DE, PSPIIA | CDAEIA, RS&DE, PSPIIA | CDAEIA, RS&DE, PSPIIA | No | No | No | No | No | RS&DE only |
| Open / auditable model | Llama-3 70B | Llama-3 70B + Frontier | Frontier only (black box) | Black box | Black box | Black box | Black box | Open weights | Open weights |
| Contractual SLA | 99.5–99.9 % | 99.5–99.9 % | 99.9 % cloud | 99.9 % cloud | 99.9 % cloud | 99.9 % cloud | 99.9 % cloud | 99.5 % | 99.5 % |
Footnotes capture three details that matter most for a Canadian buyer: jurisdiction, whether the terms can change on notice, and who owns the audit log.
OpenAI retains conversation logs for up to 30 days for abuse monitoring — accessible to OpenAI staff and to US legal process. Zero data retention is available only by separate written agreement, and only on certain models. This is not your default. United States company — CLOUD Act applies.
Uses your Microsoft Graph as context — it reads your SharePoint, Exchange, OneDrive, and Teams. Retention follows the M365 commitments, not Canadian commitments. United States company — CLOUD Act applies.
The Canadian region addresses the physics of the data, not the jurisdiction. Microsoft Corp. remains subject to the CLOUD Act. See the trust-hub section on Azure for details.
Content is not used for advertising, but it is processed by Google's global infrastructure under the control of the US parent. United States company — CLOUD Act applies.
Out of CLOUD Act reach. However, any transfer from Canada is still cross-border (GDPR ≠ Bill 25). A PIA is required. The posture is better than US vendors, but still weaker than an on-site tonia.
Out of CLOUD Act reach for workloads processed on Canadian infrastructure. This is the closest cloud posture to tonia. But: not on-premises, no on-site tonia audit log you control.