Data Residency

The problem

Your client’s procurement questionnaire asks where their ticket data lives, and you need an answer you can put in writing. Most PSA vendors answer with a region-selection dropdown and a marketing page, which tells you where the vendor intends to store data rather than where it is. When the auditor follows up — which database, in which data centre, with backups where — the answer thins out. Meanwhile the AI feature everyone turned on last quarter has been posting ticket text anywhere it was not asked for.

For a Canadian MSP under PIPEDA, or one serving public-sector clients with in-Canada requirements, “our platform supports multiple regions” is not an answer. “This one, here, and here is the backup arrangement” is.

What Solidlio does about it

Every ticket, document, attachment, invoice and audit record lives there. Database backups are geo-redundant to Azure’s paired Canadian region and retained 35 days. There is no United States deployment and no European deployment, so there is no configuration under which your data ends up in one — the product refuses to place an account in a region it does not operate, rather than accepting the setting and storing the data in Canada anyway. Where third parties do process data outside Canada — payments, email delivery, AI features — they are named individually, and the features that depend on them can be left off.

Capabilities

Built for MSPs and their clients

A managed client is a separate account with its own books, but not its own region: it inherits the MSP’s.

How it works

1. An account is created with a region — chosen at signup, or set by a platform administrator. Only regions Solidlio actually operates are offered; the rest are shown greyed out rather than hidden, so the answer to “do you offer EU hosting” is visible rather than absent.
2. The region is written to the account — and drives its default billing currency, its platform-invoice tax treatment, and, for an MSP, the country its payout account is opened in.
3. Every sign-in mints a token carrying the region — read from the account, not from anything the client sends.
4. A caller cannot assert a region.
5. Requests are served by the region’s deployment — today one, in Canada Central.
6. A refused cross-region request is recorded — source region, destination region, person, IP address, user agent and reason — and surfaced to platform administrators.

Compliance and audit

What can be reconstructed after the fact:

• Where an account was created — the region is written into the account’s creation audit entry.
• When an account’s region changed, from what, to what, and by whom — a dedicated ACCOUNT_REGION_CHANGED audit entry, separate from general account edits, and explicitly flagged as not having relocated stored data.
• Every refused cross-region request — persisted with both regions, the person and email, IP address, user agent, the reason, and whether it was blocked.
• Who may change residency — platform administrator only. No tenant role, including an MSP administrator, can move an account between regions.

Solidlio is operated by Tridacom IT Solutions Inc., a Canadian corporation based in Edmonton, Alberta.

Editions

Data residency carries no plan gate. There is no entitlement flag for it and no tier check anywhere in the code, because these are properties of the deployment rather than features of a subscription. A free account’s tickets sit in the same Canadian database, behind the same private network, as an enterprise account’s.

The one residency capability that is not universal is who can change it: platform administrator only, on every tier.