Program · Anokii · Explainer
Where does your community's data actually live?
Most First Nations and small municipal websites run on the same few tools, owned by companies in another country, on clouds the community does not control. So a simple question turns out to be hard: when you put your information into your community's website, where does it go, who can reach it, and whose laws decide? Here it is in plain terms, using the Sagamok members portal as the example.
The pieces, in plain words
A site like this is not one thing. It is a stack of services, each owned by a different company:
- The website builder. Sagamok's site runs on Webflow, a US company that publishes the pages and stores the content.
- The login layer. The members area uses Memberstack, another US company. It runs in your browser and keeps member account details, including fields like a band registration number, in its own database.
- The email tool. Member newsletters and notices go out through Mailchimp, a US company owned by Intuit, of Atlanta, which keeps member names and email addresses on its own servers.
- The trackers. The site also loads Google Analytics, which reports who looked at which page back to Google in the US.
- The delivery network. The pages and files are pushed out through a global content delivery network, or CDN, so they load fast everywhere. Webflow has used Amazon Web Services and Fastly, and now uses Cloudflare.
- The cloud underneath. All of it ultimately runs on large US cloud infrastructure, chiefly Amazon Web Services.
None of these are bad tools. The point is that a single page load reaches several US companies: Webflow, Memberstack, Mailchimp, and Google Analytics.
That long link you have seen: what it is
If you have ever opened a file on a Webflow site, you have seen a web address like this. People see it constantly and have no idea what it is. Here is what each part means (the community-specific parts are blacked out, so this is not a working link):
cdn.prod.website-files.com is the shared CDN address that every Webflow site uses, not Sagamok's alone, which is why you have seen it elsewhere. site ID identifies the website on Webflow. file hash is the file's unique code. the filename is just the document's name. Anyone with the full link could reach the file directly from the CDN, with no login. That was the heart of the disclosure, which has since been resolved.
Where this file actually lives
You cannot tell where a file lives from the address itself. But the server's own response tells you, and it is worth seeing. For Sagamok's files:
What the server's own response says: the master copy sits in Webflow's us-east-1 region, Northern Virginia, USA. Our request was answered from Cloudflare's Toronto location, where a copy had been cached for about 44 days. A member somewhere else is served from their nearest Cloudflare city, and the same file exists in cities around the world. Map is schematic; positions are approximate.
Two things follow that surprise most people. Copies of your content sit on servers around the world, not in your community and not only in Canada. And a cached copy can outlive the original, so taking something off the site does not remove every copy at once.
Whose hands it is in, and where
Storing data "in Canada" feels like it should settle the question. It does not. What matters is who controls the data, and here that is a set of US-headquartered companies on US and globally distributed infrastructure. Even a Canadian data center owned by a US company does not change who can be ordered to hand it over.
Which laws apply
This is information, not legal advice, but the shape of it matters.
- US law can reach this data. The US CLOUD Act (2018) lets US authorities compel US-based companies to turn over data they control, no matter where it is stored, without notifying the Canadian customer or getting a Canadian court's approval. It turns on who holds the data, not where it sits.
- Canadian privacy law applies too. Canada's private-sector law (PIPEDA) governs how an organization collects and uses personal information, but it cannot stop a US-compelled disclosure by a US provider. The data sits under two legal regimes at once.
- First Nations data sovereignty is the deeper standard. The recognized framework is OCAP: Ownership, Control, Access, and Possession, a registered trademark of the First Nations Information Governance Centre. In plain terms, the data belongs to the community, and the community should control how it is collected, who can access it, and where it is held. A stack of outside US companies is close to the opposite.
What this means for you
When the platform, the servers, and the laws all sit outside the community, the community cannot fully answer the basic question: is our data safe, and who can see it. Not because anyone did wrong, but because the answer is in other people's hands. That is the gap between data residency, where a file happens to sit, and data sovereignty, who actually governs it.
The stakes are not abstract. Names, band registration numbers, and contact details are exactly the kind of information that fuels targeted fraud and phishing, which is why where this data sits, and who can reach it, matters.
Your data is the community's. Deciding how it is kept, and being able to check that yourself, is part of sovereignty.
What a member or council can ask
- Where is our members' data stored, and which companies can access it?
- Are those companies subject to foreign laws that could compel disclosure?
- What did we agree to in their terms, and can we get our data back out?
- Do we have our own qualified people who can verify how it is protected?
- What would it take to move the most sensitive data onto infrastructure we control?
Sources
- Webflow hosting overview and the hosting feature page (AWS, Fastly, Cloudflare).
- Memberstack: member data and data encrypted at rest.
- CLOUD Act overview, with analysis from Osler and BLG.
- The First Nations Principles of OCAP (FNIGC).
- The Sagamok members-website disclosure, the now-resolved case study this explainer accompanies.
- The OIATC position when a foreign order can switch off your AI, the same lesson one layer up, about the models that run on this infrastructure.
A community resource from OIATC, the Ontario Indigenous AI and Technology Council, put together by Russell Jones, a Sagamok member. It explains how this technology works and what it means for community data. It is general information, not legal advice; for decisions that rely on the legal points, confirm with a privacy lawyer. Independent of Sagamok Chief and Council, and of Webflow, Memberstack, and the other companies named. Corrections welcome.