It’s clearer than ever that too much of the technology the world relies on is controlled by too few tech giants, most of them based in the United States and China.
Cloud storage, web hosting, email, social media, video calling, communication platforms, and the basic productivity tools that companies and governments use every day have become essential infrastructure. The modern economy cannot function without them. And control over that infrastructure gives both providers — and the countries whose laws they operate under — outsized power over everyone who depends on it.
We’ve been tracking this concentration for some time. Our previous research found that 74% of publicly listed European companies rely on US tech, fueling a wider debate in Europe about economic security, digital sovereignty, and geopolitical risk.
Now we’ve found that Canada is even more exposed than Europe. We examined 220 publicly listed companies representing 70% of the Canadian stock market’s total capitalization and found that 87% rely on US-owned infrastructure for their email. The same was true for 84% of the 100 largest municipalities. We also found that 14 out of 14 federal, provincial, and territorial government domains rely on American email infrastructure.
To be clear, the problem is not that these companies are American. The risk comes when too much of the infrastructure the world depends on sits under the control and jurisdiction of any single government. At a time of increasing geopolitical tensions and trade negotiations, we believe it’s important to fully understand the different levers that one country can hold over another behind the scenes.
How we measured Canada’s dependence on US tech
We collected the data using the same method as our earlier research in Europe. Using public DNS lookups, we identified the mail exchange (MX) records associated with each organization’s domain. These records show which companies handle an organization’s email, either directly or through an email security service.
For Canada, we looked at three parts of the economy and public sector:
Federal, provincial, and territorial governments. We examined all 14 federal, provincial and territorial domains. Of these, all 14 rely on Microsoft 365.
Companies. We analyzed the 220 companies in the S&P/TSX Composite Index, which together account for around 70% of the Canadian stock market’s total capitalization. Of the companies reviewed, 161 used Microsoft 365 and nine used Google Workspace for their email infrastructure.
Municipalities. Canada has more than 4,000 local governments, so we focused on the country’s 100 largest municipalities by population. Of those, 77 used Microsoft and one used Google.
Why this matters
The problem with this arrangement is quite simple: One company, headquartered in one country, operating under one country’s laws, carries the email of an entire G7 nation’s governments.
US law gives that country real power. Under the CLOUD Act, US authorities can compel American tech companies to hand over data they hold, including data stored outside the US. When the US placed sanctions on the International Criminal Court, for example, Microsoft cut off the email account of the court’s chief prosecutor(nuova finestra) — a move Microsoft initially told UK lawmakers was the ICC’s own decision, before acknowledging that testimony was inaccurate. Access to infrastructure can be withdrawn on political terms and virtually overnight.
AWS, Microsoft Azure, and Google Cloud serve an estimated 85% of the European cloud market — and when one of them fails, the failures cascade. A major AWS outage in late 2025 crashed apps across industries; an Azure outage followed nine days later(nuova finestra), knocking Outlook, Teams, and dozens of enterprise services offline for eight hours.
Much of the email infrastructure used by Canadian companies and governments depends on Microsoft, leaving them exposed to the same kind of service disruption.
These risks, however, exist regardless of which country holds leverage. A world where one government can lawfully reach into the central communications of other nations is the problem, no matter who that government is, and wherever its companies are headquartered.
Canadians are already reacting
The dependence we measured in Canada’s public and private sectors comes amid a wider rupture in Canada-US relations, including retaliatory tariffs matched dollar for dollar and trade talks that broke down in a very public manner.
This backdrop is already shaping how Canadians see their tech dependence. Politico’s reporting(nuova finestra) on Canada’s digital sovereignty dilemma describes a country forging its own path to reduce reliance on American tech, noting that its smaller economy and US-tied tech industry severely limit its bargaining power. This mirrors the shift we documented in Europe over the last year, where our research found 73% of Europeans believe their societies rely too heavily on US tech and 56% now say local infrastructure matters more to them than a year ago.
Canada’s position differs from Europe’s in one important way: European institutions have moved from diagnosis to legislation, with the European Commission’s tech sovereignty package committing major funding to local alternatives. Canadian institutions haven’t announced migration plans, and we’re not the ones to call for it. Proton is a Swiss company. What we can do is show what the data says and what it implies for anyone who depends on these systems, including what Europe’s slow, imperfect transition reveals about how hard these moves are in practice.
What any organization can do about it
For Canadian businesses and institutions assessing their own exposure, the starting steps are concrete:
List every third-party tool you use: Flag which are headquartered outside Canada and which of those fall under a foreign government’s legal jurisdiction.
Identify what would stop your operations: Which tools, cut off tomorrow, would halt work? This belongs in business continuity planning.
Check where your data sits: Which country’s laws govern it? Who can access it, and through what legal process?
Test the alternatives: For most critical tools, Canadian and European alternatives are available, and some offer built-in tools that make switching easier, such as Proton’s Easy Switch.
Move the highest-risk services first: Full migration takes time. Start with the systems you can’t operate without.
When your business email relies on US tech companies, you’re exposing your organization to strategic risks that, at the end of the day, are out of your control.
