What was the situation before?
The firm's field engineers use an offline-first app to capture site walks: photos, voice notes, typed notes, GPS and elevation, against the firm's own checklists. The app was deployed in August 2026 on Microsoft Azure in Canada Central: Container Apps, PostgreSQL with PostGIS, and Blob Storage. Voice notes are transcribed there too. The app's requirements ask for Canadian hosting.
The AI report drafting didn't follow. As written, the code sent each report section's captures (transcripts, comments, captions, GPS and checklist state) to a model service outside Canada. That's the firm's survey evidence, and the problem sat in one line of code: easy to miss in a review. In production, drafting had never been switched on, so no survey evidence had left Canada; the code as written would have sent it.
What did we change, step by step?
-
Traced every hop
Records, photos and voice-note transcription were in Azure Canada Central. Report drafting was not. Staff sign-in stores names and sign-in logs in the United States: a deliberate decision recorded on 20 August 2026 and caught before the sign-in tenant was created, because Microsoft's sign-in service for this app offers no Canadian storage location.
-
Picked a model that is processed in Canada
A Standard deployment of gpt-4.1-mini in Azure Canada East. Microsoft's own documentation suggests starting with Global Standard, which "may be processed in any Azure region"; a Standard deployment in a Canadian region processes prompts inside the Canadian geography. When we last checked, the chat models offered that way in Canada East were gpt-4.1-mini and gpt-4o.
-
Signed in without a stored key
The app reaches the model with its own managed identity, given one role (Cognitive Services OpenAI User) on that one model account. There is no key sitting in its settings to leak.
-
Made it fail loudly
If the Canadian model isn't configured, drafting stops with an error. It never switches to a service outside Canada on its own: a quiet fallback is the real risk, because every draft still looks normal and nobody notices. Automated tests check that the default is Canada, that a missing endpoint fails without a network call, and that the old outside-Canada path, which is still in the code, runs only when someone deliberately switches it on.
-
Kept a trail
Each draft is stored with the model version and a fingerprint of the prompt that produced it, so any sentence in an issued report can be traced back to what produced it.
-
Put the retirement date in the calendar
Both in-region models retire on April 13, 2027, so the choice needs revisiting before then. The model name and version are settings, so changing them is a configuration change.
Which tools does it use?
- Azure OpenAI
- gpt-4.1-mini
- Standard deployment
- Azure Canada East
- Managed identity
- Azure Container Apps
- Azure Database for PostgreSQL
- PostGIS
- Azure Blob Storage
- Whisper on Azure OpenAI
- Microsoft Entra ID
- Next.js
- Bicep
Where does each piece run now?
The app's data map, before and after the change. This is the kind of map your privacy officer gets with your build.
| Piece | Where it runs | In Canada? |
|---|---|---|
| Survey records | Azure Database for PostgreSQL, Canada Central | Yes |
| Photos and documents | Azure Blob Storage, Canada Central | Yes |
| Voice-note transcription | Whisper on Azure OpenAI, Canada Central | Yes |
| Report drafting, as first coded | A model service outside Canada. Never switched on in production, so nothing was sent. | No (code only) |
| Report drafting, since 10 Nov 2026 | gpt-4.1-mini, Standard deployment, Canada East | Yes |
| Staff sign-in records | Microsoft's identity service, United States | No |
What does the AI do in this app, and what doesn't it?
It does
- Transcribe voice notes. The transcript is editable and the audio is kept.
- Draft one report section at a time from the captures only, told never to invent equipment, dimensions, counts, dates or names.
- Check every photo it references against a real capture, and report the ones that don't match.
It doesn't
- Issue a report. Only a reviewer or admin can, and only with a change note.
- Change a field record or a measurement.
- Draft anything for a user without the reviewer role.
What is still outside Canada?
Staff sign-in. The app uses Microsoft's identity service for staff sign-in, which stores names and sign-in logs in the United States. That location can't be changed once the tenant exists; the decision was recorded on 20 August 2026, so it's written in the data map instead of being left for someone to discover. The move to Canada East covers the survey evidence, not the directory.
Where does it stand today?
Deployed. The in-region drafting was deployed on 10 November 2026. The app itself has run on Azure since August 2026, with 507 unit tests and 24 end-to-end browser tests.
Live drafting test with a signed-in reviewer: pending. Drafting needs a reviewer's sign-in, so the live check of a real draft coming back from the Canada East model hasn't been run yet.
What would this look like for your document assistant?
This is the cloud-region version of what we set up. If your files may sit in a Canadian cloud region, the document assistant can use an in-region model like this one instead of a model on your own server. There's no hardware to buy, and answers come faster than on a CPU-only server. The catch: the newest models arrive in-region last, if at all.
- Model
- An in-region Standard deployment in a Canadian Azure region, chosen from what's offered there
- Access
- A managed identity with one role, and no stored keys
- Fallback
- None. Tests prove a missing Canadian endpoint fails without any network call
- Trail
- Model version and prompt fingerprint stored with each answer
- The price
- Build from $995, fixed in writing. Your Azure costs are yours and estimated in writing first. Support is $99 a month.
Questions about this build
Is Azure OpenAI available in Canada?
Yes, with conditions. A Standard deployment in Azure Canada East is processed in Canada. When we last checked, the chat models offered that way there were gpt-4.1-mini and gpt-4o. Global deployments, Microsoft's suggested starting point, may be processed in any Azure region.
Is a Canadian cloud region enough on its own?
No. The region decides where data is stored. The deployment type decides where prompts are processed, and sign-in, logging and monitoring each have their own location. We check every one and write it in the data map. In this app, staff sign-in data is still stored in the United States.
Can we use Claude and keep processing in Canada?
Possibly. At the end of October 2026, Amazon Bedrock added a Canada cross-Region inference option for Claude Haiku 5.5 that routes only between its Canada Central and Canada West regions; AWS's model card lists both regions (checked 12 November 2026). Check the current AWS documentation before relying on it. It's an option we'd compare against the alternatives in a prototype.