Where Your Website's Server Actually Is

A question nobody asked

Ask most business owners where their website lives and they will name the company they pay each year, not a city.

The company may be in Vancouver. The server may be in Arizona, Texas or Virginia, because that is where the plan somebody chose years ago happened to run.

Many Canadian business sites are hosted in the United States without anybody deciding it. Some hosts with Canadian addresses rent their servers south of the border, and large hosts place accounts wherever they have room.

Location changes a few things that matter. It does not change several that people assume it does. Worth knowing which is which.

What location changes

• Speed for nearby visitors, since every round trip takes longer over distance.
• What you should tell customers about where their information is kept.
• Which country's laws apply when authorities ask the host for data.
• Contracts with larger customers that say where data may be stored.

The second is the one most businesses have never considered, even though their privacy policy may already make a claim about it, written by somebody who assumed.

What it does not change

Search rankings in Canada depend very little on where the server is. Google relies far more on a .ca domain, the country setting in Search Console for other domains, and what the pages say about where you work.

Security depends on how a server is run, not where. A well-maintained server abroad is safer than a neglected one down the street.

So moving to a Canadian server will not, by itself, lift a site in Canadian search results.

Speed and distance

Every request a browser makes travels to the server and back. Light in fibre is fast, but a trip across the continent and back still takes a measurable fraction of a second.

A page needs several such trips before it starts to draw: opening a connection, agreeing the encryption, then fetching the page and the files it calls for. Each pays the distance again.

On a phone on a mobile network, where every trip is already slower, the extra distance adds up to a delay a visitor can feel.

Closer is not always Canadian, either. For a visitor in Kelowna, a server in Seattle is far nearer than one in Toronto.

Finding out where it is

Ask your host which data centre city your account is on. A good host answers in one line.

Ask where the backups are kept, since they are often somewhere else. Online lookup tools will also locate a server roughly, though a content delivery network in front of the site shows its own location instead.

Then list everything else holding customer information: email, the form service, the booking system, the newsletter platform. Each may sit in a different country from the website.

A worked example

A small recruitment firm in Nanaimo, placing office and accounting staff, received a supplier questionnaire from a larger client asking where candidates' information was stored.

The partners assumed the answer was Canada. Checking took an afternoon and produced a longer answer.

The website sat on a server in the United States, chosen years earlier as the cheapest plan. Its application form kept every resume in a folder on that server, along with a copy of every message.

Backups of that folder went to a second provider elsewhere, and nobody at the firm had known either fact.

The firm changed the form so nothing was kept on the web server, moved applications into the Canadian-hosted recruiting system it already used for placements, and rewrote its privacy policy to say where each kind of information was kept.

The questionnaire got a short, accurate list, which was what the client wanted. A Canadian host is still under consideration, but it matters much less now that the website holds nothing sensitive.

What the law expects

The summary below is general information, not legal advice.

Canadian privacy law generally allows a business to store or process personal information outside Canada. The business remains responsible for it, and is expected to protect it through its contracts with suppliers.

It should also be open about it, telling customers their information may be processed in another country, where that country's courts and authorities may be able to reach it.

Some provincial privacy laws add conditions of their own, and some industries expect more. For anything sensitive, ask a lawyer before moving or storing it.

What to tell customers

A privacy policy should say what you collect, which countries it is stored in, what kinds of suppliers process it, and how long you keep it.

"Your information is stored securely in Canada" is a common line, and often untrue for at least one part of the business. An accurate sentence naming both countries beats a reassuring one that is wrong.

Check the policy against the list you made. Where they disagree, change whichever is wrong.

When Canadian hosting is worth it

There are good reasons to choose a server in Canada: customers or contracts that ask for it, clients in sensitive fields who expect it, or visitors concentrated near a Canadian data centre.

It can cost more, and the choice is narrower. A well-run host in Seattle will serve a Vancouver business better than a poorly run one in Toronto.

Moving a site is routine work for a web company: built on the new server first, tested, then switched over without the site going down. Not something to rush on a Friday.

The counter-case

For a simple brochure site that stores nothing about anybody, location matters little beyond speed, and caching or a content delivery network handles most of that.

A business whose customers are spread across North America may be better served by a central location than a Canadian one.

And a move should have a reason, not just a flag. Know where everything is, tell customers accurately, and choose a location for speed and data rather than rankings.

Find out this week

1. Ask your host which city the server is in.
2. Ask where the backups are kept.
3. List every other service holding customer data.
4. Check what your forms store on the server.
5. Compare the list with your privacy policy.
6. Correct whatever the policy gets wrong.
7. Choose a location for speed and data, not rankings.

Step four often matters more than the city. Information the website never keeps cannot end up anywhere unexpected.

How HTTP/2 reduces the cost of all those round trips is covered in HTTP/2 and speed advice that has expired.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.