Canada is not the U.S. and it's not the EU. A signing service that checks the American boxes doesn't automatically satisfy a Canadian business's obligations under PIPEDA or, for Quebec, Law 25. Here's what a Canadian-friendly e-signature service actually does — and what EZ PDF Editor was built to do.
The Canadian rules, quickly
- PIPEDA — Canada's federal private-sector privacy law: consent, purpose, accountability, safeguards, and individual access.
- Quebec Law 25 — goes further: privacy-by-default, a Privacy Impact Assessment (PIA), a designated privacy officer, breach reporting, and defined retention.
- Electronic transaction laws — every province recognizes electronic signatures for most agreements, which is what makes e-signing legally binding here.
What that means for a signing service
- Consent that's real — guests give explicit consent before joining and signing, and that consent is written into the audit record.
- Privacy by design — core tools run in the browser with nothing uploaded; only what's necessary is processed server-side.
- A PIA — a privacy impact assessment that documents the data flows. Ours is public: /pia.
- A privacy officer — a named person accountable for personal-information protection.
- Evidence you can keep — tamper-evident seals, Audit Reports, and audit trails that document who signed, when, and from where.
Where your data lives
The service's server and database are hosted in Canada (DigitalOcean, Toronto region). The limited, disclosed transfers — OpenAI for AI drafts, SendGrid for email, Stripe for billing — are documented in the privacy policy, which is what PIPEDA's accountability principle and Law 25's transfer rules expect.
Retention that's defined
Retention limits are set out in the policy and enforced where the service controls the data: account deletion purges sessions, audit events, IDV submissions and files; IDV images are destroyed once their purpose ends. You keep what the law or your profession requires — the sealed PDF and Audit Report — in your own records.
Sign Canadian, compliant
Consent, a published PIA, a privacy officer, Canada-hosted infrastructure and tamper-evident records — built for Canadian practice.
Start signing →The short version
For Canadian signings, PIPEDA and Law 25 set the bar: real consent, privacy-by-design, a PIA, a privacy officer, defined retention and Canada-hosted data. EZ PDF Editor is built to that bar — and the PIA is public so your review can start from a real document.