Upper Harbour provides a comprehensive intelligence platform that maps the jurisdictional and legal exposure of technology tools used by Canadian organizations.
Funding
Funding not disclosed
Founders
Product
Problem
Canadian organizations use software and infrastructure owned by foreign companies, exposing their data to foreign legal regimes such as the U.S. CLOUD Act, the U.K. Investigatory Powers Act, and Australia’s Assistance and Access Act. This jurisdictional exposure creates compliance, regulatory, and sovereignty risks that are not captured by simple data‑residency checks.
Solution
Upper Harbour delivers a technology sovereignty intelligence platform that maps the ultimate corporate ownership, jurisdiction of incorporation, and compelled‑disclosure exposure for 768 SaaS, infrastructure, and hardware tools used by Canadian enterprises. By tracing each product to its ultimate parent entity, the platform classifies tools into Exposed, Review, Non‑Exposed, or Canadian categories, highlighting CLOUD Act and equivalent risks. Users can run a free browser‑based HarbourScan to see a jurisdictional map of their stack, obtain a paid Sovereignty Snapshot assessment for a detailed exposure report, or purchase full compliance documentation that includes TIA guidance, ROPA registers, and remediation roadmaps. Ongoing monitoring subscriptions keep the classifications up‑to‑date as vendors are acquired or change hosting arrangements, ensuring continuous compliance with Canadian privacy laws such as PIPEDA and Law 25.
Target Audience
Primary customers are Canadian enterprises, government agencies, and regulated industries that must demonstrate jurisdictional compliance for their SaaS and cloud portfolios, as well as procurement and legal teams responsible for data‑sovereignty risk assessments.
Features
- Comprehensive database of 768 technology tools with parent‑company ownership, incorporation jurisdiction, and CLOUD Act exposure metadata
- Automated classification engine that assigns each tool to Exposed, Review, Non‑Exposed, or Canadian categories based on a transparent, traceable methodology
- Free HarbourScan web tool that instantly maps an organization’s SaaS stack and flags jurisdictional risks without storing any data
- Paid Sovereignty Snapshot report delivering a full exposure map, risk scores, and prioritized gap analysis within five business days
- Full compliance documentation package (including TIA guidance, Register of Processing Activities, and regulatory mapping) for audit‑ready evidence
- Ongoing monitoring service that alerts clients to vendor ownership changes, hosting shifts, and new compelled‑disclosure legislation
- Exportable reports and API access for integration with internal governance or procurement workflows