Ontario's Procurement Restriction Policy: What It Means for Collaboration Tools in 2026

In 2025, Ontario introduced a Procurement Restriction Policy that bars US-headquartered businesses (with fewer than 250 Canadian employees) from winning new provincial government contracts. For public sector teams that rely on tools like Miro, FigJam, or Mural for workshops, planning sessions, and team collaboration, this policy has created an urgent gap.

If you are a procurement officer, IT director, or team lead at an Ontario ministry, crown agency, hospital, school board, or municipality, this article explains what the policy means, why common workarounds do not apply, and how to find compliant alternatives through CanadaBuys and other federal procurement channels.

What the Policy Actually Restricts

The restriction is based on corporate headquarters, not where the servers are located. This is a critical distinction that many teams misunderstand.

Miro is headquartered in San Francisco. FigJam (Figma) is headquartered in San Francisco. Mural is headquartered in San Francisco. All three are blocked from new Ontario public sector contracts regardless of where they claim to store your data.

A US-based company cannot solve this by opening a Canadian data centre. The restriction targets the legal entity, not the infrastructure. Here is why:

• CLOUD Act (2018): US law can compel American companies to produce data they control, wherever it is stored. Because the policy targets US-headquartered vendors, a US company cannot escape it by opening a Canadian data centre — the company itself remains US-controlled and compellable.
• Corporate control: For a company like Miro to truly comply, it would need to establish a genuinely independent Canadian entity with 250+ employees, free from US corporate control. That represents $25-37M in annual payroll, a structural barrier that is unlikely to be addressed.

This is not a temporary inconvenience. The policy reflects a broader shift toward digital sovereignty across Canadian governments, reinforced by Prime Minister Carney’s sovereign cloud initiative at the federal level.

Who Is Affected

Ontario’s policy applies to over 900 organizations:

• 29 Ontario ministries
• 19+ crown agencies (LCBO, Ontario Power Generation, Metrolinx, Infrastructure Ontario, Ontario Health, WSIB, IESO, OLG, and others)
• 76 school boards
• 140+ hospitals (with additional motivation from PHIPA data residency requirements)
• 22 universities and 24 colleges
• 444 municipalities

Any of these organizations currently using Miro, Mural, FigJam, or similar US-based collaboration tools on existing contracts will need to find Canadian alternatives when those contracts expire or come up for renewal.

The Federal Picture: CanadaBuys and GC SaaS

Ontario is not alone. The federal government is moving in the same direction through its own procurement frameworks.

CanadaBuys is the Government of Canada’s procurement portal, listing tender opportunities and standing offers for federal departments and agencies. Federal buyers increasingly look for SaaS tools that meet Canadian data residency requirements and are listed on approved procurement vehicles.

The GC SaaS RFSA (Request for a Supply Arrangement) is a federal framework specifically designed to pre-qualify SaaS vendors for government use. Once a vendor is listed on the GC SaaS framework, federal departments can purchase directly without running a full procurement process each time, dramatically reducing friction.

For collaboration and whiteboarding tools, this means federal departments like the Immigration and Refugee Board of Canada or Transport Canada can adopt Canadian-hosted platforms quickly if they are on an approved framework.

Other provinces are following similar patterns. British Columbia, Alberta, and Quebec all have organizations evaluating their US SaaS dependencies in light of sovereignty concerns. Quebec’s Loi 25 (privacy legislation) adds additional requirements for data handling that favour Canadian-headquartered vendors.

What to Look for in a Compliant Collaboration Tool

When evaluating alternatives to Miro or similar platforms, procurement teams should verify:

1. Canadian incorporation and headquarters. The vendor must be a Canadian company, not a US company with a Canadian office.
2. Canadian data residency. All data, including metadata, backups, and logs, must remain in Canada.
3. Canadian vendor jurisdiction. The vendor should be a Canadian-controlled entity, not a US company subject to the CLOUD Act. Most cloud infrastructure providers are US-based, so what matters for the restriction is the vendor’s own corporate nationality alongside Canadian data residency.
4. Enterprise readiness. SSO (SAML and OIDC), role-based access, audit capabilities, and data export support.
5. PIPEDA compliance. Alignment with Canadian federal privacy legislation, and provincial equivalents where applicable (PHIPA in Ontario, Loi 25 in Quebec).

Bizby: Built in Canada for Canadian Teams

Bizby is a Canadian-headquartered visual collaboration platform built specifically for teams that need sovereignty-compliant tools without sacrificing functionality.

Bizby is already in use by federal and provincial government teams across Canada.

Data residency: Board content and user data, including boards, user profiles, team configurations, and document history, are stored in Canadian Google Cloud regions (Montreal). For enterprise customers requiring dedicated Canadian compute, Bizby offers a fully Canada-hosted option with real-time collaboration running on infrastructure pinned to Toronto, ensuring that both data storage and processing remain within Canadian borders.

Core capabilities:

• Real-time multiplayer whiteboarding
• AI-powered summaries, affinity mapping, and text tools
• Templates for workshops, retrospectives, and sprint planning
• Polls and dot voting for decision-making
• Guest access for external stakeholders
• SSO support (SAML and OIDC)
• Version control and document history
• Miro and Mural import (bring your existing boards)

Pricing starts at $5.99/seat/month for teams, significantly below Miro’s pricing, with transparent, PCard-friendly options.

Next Steps for Procurement Teams

If your organization is affected by Ontario’s Procurement Restriction Policy or federal data residency requirements:

1. Audit your current tools. Identify any US-headquartered SaaS in use for collaboration, whiteboarding, or workshop facilitation.
2. Check contract expiry dates. Existing contracts may be grandfathered, but renewals and new purchases must comply.
3. Search CanadaBuys. Look for Canadian-hosted alternatives that are listed or in the process of qualifying on federal procurement frameworks.
4. Request a demo. Contact Bizby to see how Canadian teams are already collaborating without US SaaS dependencies.

---

Bizby is a Canadian-founded, Canadian-hosted collaboration platform trusted by federal government agencies. Learn more at bizby.ca.

---

References

1. Ontario Procurement Restriction Policy — Official Ontario government policy page.
2. Procurement Restriction Policy: Guide for Public Sector Buyers — Supply Ontario implementation guidance (PDF).
3. Procurement Restriction Policy: FAQs — Supply Ontario frequently asked questions (PDF).
4. CLOUD Act (H.R.4943) — US federal law compelling American companies to produce data stored anywhere in the world. Congress.gov.
5. CLOUD Act Resources — US Department of Justice overview of the CLOUD Act.
6. CanadaBuys — Government of Canada procurement portal for tender opportunities and supply arrangements.
7. GC SaaS Supply Arrangement — Public Services and Procurement Canada overview of the SaaS supply arrangement framework.
8. PIPEDA — Office of the Privacy Commissioner of Canada overview of the Personal Information Protection and Electronic Documents Act.
9. PHIPA — Ontario’s Personal Health Information Protection Act, 2004. Ontario e-Laws.
10. Quebec Law 25 — Act respecting the protection of personal information in the private sector (as amended by Law 25). Legis Quebec.