I’m planning self-hosted Directus projects for a few Canadian clients, and some of them have to keep personal data in Canada because of PIPEDA, plus stricter public-sector rules in BC and Quebec. Here’s the checklist I’m working from. I’d like to hear what others would add.
- Run Directus and its database on servers in a Canadian data centre, and check that managed database backups stay in Canada too.
- Point the file storage adapter at Canadian object storage or local disk, not a default bucket in another region.
- Keep the cache and rate-limiter store, such as Redis, in the same Canadian location.
- Review activity and revision tracking, and set a retention plan, since those tables keep copies of changed records.
- Check what flows, webhooks and extensions send to outside APIs, and remove or relocate any that move personal data abroad.
- Use roles and permissions so public and API access only exposes what each client approves.
- Back up the database and uploads to Canadian storage, test a full restore, and document where every copy lives.
For those running Directus for clients: how do you keep track of which flows or extensions send data outside the country?