Stelld is a form builder built and hosted in Canada. Here’s exactly where your data lives, which laws protect it, and how we compare to the American alternatives.
Data residency
Every form you build and every submission you collect is stored in Amazon Web Services’ Canadian region (ca-central-1, Montréal). That’s not a premium add-on — it’s the only way Stelld works.
The database and file storage both run in AWS ca-central-1. Backups stay in Canada too.
Submissions are encrypted with keys unique to your account, on top of disk encryption and TLS 1.2+ on every connection.
Passwords are hashed with bcrypt, and team roles (Owner, Editor, Viewer) limit who can see and change what.
Why it matters
Under PIPEDA, your organization stays accountable for personal information you hand to a service provider — wherever that provider stores it. If your form tool is American, your compliance story depends on theirs.
US providers are subject to American laws like the CLOUD Act, which can compel them to disclose data they control — even data stored outside the United States. Storing Canadians’ data with a Canadian provider on Canadian infrastructure keeps things simple.
Some Canadian rules go further: Quebec’s Law 25 requires assessments before sending personal information outside the province, and public bodies in provinces like British Columbia and Nova Scotia face data-residency expectations of their own. Keeping data in Canada from day one avoids the paperwork.
Encryption
Yes, AWS is an American company — and Stelld is designed around that. Every submission is encrypted inside Stelld before it is stored, with keys unique to your account.
Those keys are held by a Canadian-owned provider in Montréal, not by Amazon. What sits in the database and its backups is unreadable on its own: anyone who obtained it would hold ciphertext, not answers. Stelld decrypts a submission only in memory, at the moment you view or export it.
For the technically curious: each form has its own AES-256-GCM data key, wrapped by a master key unique to your account. Master keys never leave an open-source key management service running on Canadian-owned infrastructure in Montréal. The database only ever sees wrapped keys and ciphertext.
Compliance
PIPEDA — Canada’s federal privacy law — sets out fair information principles for handling personal data. Here’s how Stelld’s design maps to them.
Per-account encryption of submissions, TLS in transit, bcrypt-hashed passwords, and role-based access control.
A plain-English privacy policy and a published list of every sub-processor we use.
Export all of your submissions to CSV, anytime.
Data is kept only while your account is active. Delete your account yourself, anytime, from your preferences — its forms and submissions go with it.
A session cookie for login, plus Google Analytics for aggregate usage statistics — no advertising trackers, no selling of your data.
Canadian-owned and operated, governed by Canadian law.
The alternatives
The popular form builders are excellent products — but they’re American companies, and that has consequences for where your data lives and which laws reach it.
| Criteria | Stelld | JotForm | SurveyMonkey | Google Forms |
|---|---|---|---|---|
| Company jurisdiction | Canada | United States | United States | United States |
| Vendor is a US company subject to the CLOUD Act | No | Yes | Yes | Yes |
| Form data stored in Canada | Always — every plan | Not by default | Not by default | Not by default |
| Billed in Canadian dollars | Yes | No (USD) | No (USD) | N/A (free tier) |
Comparison reflects publicly available information as of September 2026. JotForm, SurveyMonkey, and Google Forms are trademarks of their respective owners.
Transparency
No vague promises — here are the services involved in running Stelld, what each one sees, and where it operates.
| Service | What it handles | Where |
|---|---|---|
| Amazon Web Services | All form data, submissions (encrypted), and uploaded files | Canada (Montréal) |
| VEXXHOST | Encryption keys only — never form content or submissions | Canada (Montréal) · Canadian-owned |
| Stripe | Payment details, if you collect payments or subscribe to a paid plan | United States (PCI-DSS certified) |
| Resend | Email addresses, for transactional email like notifications and password resets | United States |
| Google Analytics | Aggregate usage statistics (page views, device type) — never form content or submission data, and never loaded on public form pages | United States |
Your submissions never leave Canada. VEXXHOST holds encryption keys and never sees them. Stripe, Resend, and Google Analytics only handle the specific data listed above — the same disclosure you’ll find in our Privacy Policy.
Stelld is built to support your PIPEDA obligations: Canadian data residency, encryption, access controls, export, and deletion on request. PIPEDA compliance ultimately applies to how your organization collects and uses personal information — Stelld gives you infrastructure that makes that story simple.
In Amazon Web Services’ Canadian region (ca-central-1) in Montréal, Québec — the database, uploaded files, and backups. Encryption keys are held separately, by a Canadian-owned provider, also in Montréal.
The people you invite, with the role you give them (Owner, Editor, or Viewer). A small number of Stelld staff can access production systems when operating and supporting the Service. Submissions are encrypted with keys unique to your account, passwords are hashed, connections are encrypted, and we don’t sell or mine your data.
Export any form’s submissions to CSV anytime. You can delete your account, along with all of its forms and submissions, yourself from your account preferences.
Keeping personal information in Canada simplifies Law 25’s rules on communications outside Québec, and the product is fully bilingual. As with PIPEDA, your obligations depend on your own practices — but the data-residency question is settled from day one.
Yes — built, owned, and operated in Canada, hosted on Canadian infrastructure, with pricing in Canadian dollars.
Yes. That’s why submissions are encrypted before they reach AWS, with keys held by a Canadian-owned provider rather than by Amazon. AWS stores and backs up your submissions as ciphertext.
Start collecting registrations, sign-ups, and surveys on forms hosted entirely on Canadian soil.
Get started free →