I set up openHAB for a few Canadian clients, and some of them want their home and building data to stay in Canada because of PIPEDA and provincial rules in BC and Quebec. Running openHAB locally helps a lot, but data still leaks out in a few places. These are the things I check:
- Remote access. If clients use a cloud connector for remote access, I check where that service runs, or I use a VPN to a Canadian server instead.
- Persistence. Item history in InfluxDB, MariaDB or other stores shows when people are home, so the database stays on the local machine or a Canadian server.
- Bindings. Some bindings talk to vendor clouds in other countries, so I list which devices depend on outside services.
- Voice assistants. Voice integrations send commands abroad, so clients decide on those knowingly.
- Logs. Event logs reveal daily routines, so I keep retention short.
- Backups. Configuration and persistence backups go to encrypted Canadian storage, and I test a restore on spare hardware.
- Notifications. Push notifications pass through outside services, so I keep the text generic.
What else do you check when a client wants their smart home data kept inside one country?