OCAP® Principles
Your data. Your Nation. Your rules.
Aegisys Cloud Solutions is committed to supporting First Nations OCAP® principles — Ownership, Control, Access, and Possession. Our 100% Canadian infrastructure, SOC 2 Type II certified operations, and zero-foreign-jurisdiction hosting make us a trusted partner for Nations that take data sovereignty seriously.*
O
Ownership
C
Control
A
Access
P
Possession
Land Acknowledgment
Aegisys Cloud Solutions operates in Sudbury, Ontario, situated on the traditional, ancestral, and treaty territory of the Atikameksheng Anishnawbek and Wahnapitae First Nation, within the Robinson-Huron Treaty territory of 1850. We acknowledge the enduring presence, the living cultures, and the contributions of Anishinaabe peoples to this land. As we serve First Nations communities across Canada, we are committed to respectful, nation-to-nation relationships and to upholding the data sovereignty principles that protect Indigenous knowledge, data, and community information.
Our commitment extends beyond acknowledgment. We build our services to actively support Indigenous data sovereignty — because words mean nothing without infrastructure to back them up.
What is OCAP®?
The standard for First Nations data sovereignty
OCAP® principles were developed by the First Nations Information Governance Centre (FNIGC) and have become the recognized standard for how First Nations, Métis, and Inuit peoples assert sovereignty over their data, research, and information.
In an era of cloud computing and digital services, OCAP® isn't just a policy framework — it's a practical demand: your Nation's data must stay under your Nation's control, on infrastructure you can trust, in a jurisdiction that respects your rights.
Aegisys is built for exactly this. Every service we offer to First Nations organizations is designed with OCAP® alignment as a foundational requirement — not an afterthought.
Doc says
"Data sovereignty is non-negotiable."
When a First Nations community stores their data with a cloud provider, they need a guarantee — not a promise. They need to know that their information will never be accessed by foreign governments, never be shared without consent, and will always remain under their Nation's control.
That's why Aegisys operates exclusively in Canadian data centres, under Canadian law, with zero US or foreign cloud infrastructure in our stack. OCAP® compliance isn't a checkbox for us — it's how we were built.
Why it matters today
- US CLOUD Act can compel US cloud providers to hand over data stored anywhere in the world
- AWS, Azure, and Google Cloud are US-headquartered — subject to US law
- Canadian-only infrastructure eliminates this exposure entirely
How Aegisys Supports Each Principle
OCAP® in practice — not just on paper
Every letter of OCAP® maps directly to capabilities built into our infrastructure, contracts, and operating practices.
Ownership
The Principle
“A community or group owns information collectively — in the same way that an individual owns their personal information.”
How Aegisys Supports It
- Your data is never co-mingled with other clients — isolated, private infrastructure
- No third-party access to your data without explicit written authorization
- Data ownership terms documented clearly in our master agreement
- You retain full ownership of all data hosted in Aegisys Canadian infrastructure
Doc says
“Your data belongs to your Nation — full stop. We never claim any right to your information, and our infrastructure is built to keep it that way.”
Control
The Principle
“First Nations people, their communities, and representative bodies have the right to control all aspects of research and information management processes that affect them.”
How Aegisys Supports It
- Role-based access control — you define who can see and touch your data
- Zero-trust JIT (Just-In-Time) access — Aegisys staff require authorization before accessing your environment
- Complete audit trail of every access event, every configuration change
- You can revoke access instantly — no standing privileges remain
Doc says
“Control means nothing if your IT partner can log in anytime without your knowledge. Every Aegisys access to your environment is time-limited, logged, and authorized by you.”
Access
The Principle
“First Nations people must have access to information and data about themselves and their communities, regardless of where it is held.”
How Aegisys Supports It
- Secure Remote Access Portal — encrypted, MFA-secured access to your data from anywhere
- Full data export on request — no lock-in, no barriers
- Monthly reports and dashboards in plain language for leadership
- Designated access rights for band leadership, administrators, and departments
Doc says
“It's your data. You should be able to access it whenever you need it — and we've made sure your team can do exactly that, securely, from any location.”
Possession
The Principle
“Possession refers to the physical control of data. While data may be held by others, the Nation must retain the mechanism to safeguard it.”
How Aegisys Supports It
- 100% Canadian data centres — Sudbury, Ontario, under Canadian jurisdiction exclusively
- No US CLOUD Act or foreign government access to your data — ever
- Data never leaves Canada: not for backup, not for processing, not for analytics
- Physical infrastructure is owned and operated by Aegisys in Canada
Doc says
“Possession is where data sovereignty becomes real. Your data lives in our Sudbury data centres — on Canadian soil, under Canadian law, with zero foreign jurisdiction exposure. That's our promise and our guarantee.”
Infrastructure Built for Sovereignty
Six reasons First Nations trust Aegisys with their data
OCAP® compliance requires more than good intentions. It requires infrastructure, contracts, and processes that physically and legally protect your Nation's data.
100% Canadian Infrastructure
Both data centres are located in Sudbury, Ontario. Your data never crosses the border for any reason.
SOC 2 Type II Certified
Independent third-party audit verifies our security controls. Not just promises — independently verified.
PIPEDA & Privacy Act Aligned
Our infrastructure and practices support Canadian federal and provincial privacy requirements.
Zero Foreign Jurisdiction
US CLOUD Act does not apply. No exposure to foreign government data demands.
Isolated Tenancy
Your infrastructure is dedicated to your Nation — not shared with any other organization.
Transparent Contracts
Data ownership, access rights, and exit terms are clearly defined in plain language.
The Simple Test
Ask your current or prospective IT provider these questions
- 1Where, physically, does my data live?
- 2Is your company or infrastructure incorporated in the United States?
- 3Can a foreign government legally compel you to provide access to my data?
- 4Who at your organization can access my environment right now, without asking me?
- 5If I asked to see a full audit log of access to my data, could you provide it today?
Aegisys answers:
Sudbury, Ontario. No. No. Nobody — JIT access only. Yes, immediately. We have nothing to hide because we built our infrastructure so there's nothing to hide.
Our commitment
"We recognize that data is not just information — for First Nations communities, it is cultural heritage, governance records, health data, and community identity. We take that responsibility seriously, and we've built our entire infrastructure to honour it."
— Aegisys Cloud Solutions
OCAP®-Aligned Services
Infrastructure and services built for your Nation
Every Aegisys service offered to First Nations organizations is designed with data sovereignty, Canadian residency, and OCAP® alignment as non-negotiable foundations.
Private VPS Hosting
Dedicated virtual servers in Canadian data centres. Full control. OCAP-aligned infrastructure with isolated tenancy and zero foreign exposure.
Explore VPS HostingMyCloud Private
Private cloud infrastructure for your Nation. No multi-tenancy, no shared resources, complete data residency in Sudbury, Ontario.
Explore MyCloudSecureONE Cybersecurity
24/7 SOC monitoring, EDR/XDR protection, and incident response — so threats to your Nation's data are caught and neutralized in real-time.
Explore SecureONEFirst Nations IT Services
Managed IT, Microsoft 365, disaster recovery, and more — all tailored to the needs of First Nations governments and organizations.
View All ServicesFAQ
What is OCAP® compliance? Common questions answered.
Straight answers on OCAP® principles, data sovereignty, and what they mean for your Nation's IT infrastructure.
What is OCAP® compliance?
OCAP® stands for Ownership, Control, Access, and Possession — a framework developed by the First Nations Information Governance Centre (FNIGC) that defines how First Nations communities assert sovereignty over their data and information. 'Compliance' means your IT provider actively upholds all four principles in practice: through infrastructure design, access controls, contracts, and audit trails — not just policy statements.
Why does OCAP® compliance matter for IT and cloud services?
When you store data in the cloud, sovereignty can erode invisibly. US-based cloud providers — even those with Canadian data centres — are subject to the US CLOUD Act, which allows foreign governments to demand access to your data regardless of where it is stored. OCAP® compliance requires your IT partner to operate exclusively under Canadian jurisdiction, with documented access controls and legal protections that align with your Nation's rights to govern its own data.
Does OCAP® compliance require data to stay in Canada?
Yes. The Possession principle requires physical and legal control of data — meaning it must reside in Canadian infrastructure, not just be logically isolated in a US-based platform with Canadian servers. AWS, Azure, and Google Cloud are US-headquartered companies subject to US law regardless of server location. Aegisys operates exclusively from our own Sudbury, Ontario data centres, under Canadian law, with zero foreign jurisdiction exposure.
What is the difference between OCAP® and PIPEDA or PHIPA?
PIPEDA and PHIPA are Canadian privacy laws that apply broadly to organizations handling personal information. OCAP® is a self-determination framework specific to First Nations communities that goes further: it asserts collective community ownership of data and the right to govern how it is collected, used, and shared. OCAP® compliance includes PIPEDA/PHIPA alignment — but adds governance, cultural context, and sovereignty considerations that general privacy law does not address.
How do I know if my current IT provider is OCAP®-aligned?
Ask five questions: (1) Where, physically, does our data live? (2) Is your company incorporated or headquartered outside Canada? (3) Can a foreign government legally compel you to hand over our data? (4) Who at your organization can access our environment right now, without asking us? (5) Can you provide a full audit log of all access to our data today? If any answer is unsatisfactory — or if they can't answer — your data sovereignty is at risk. Aegisys answers every one of these questions directly and in writing.
Ready to talk data sovereignty?
No jargon. No sales pitch. Just a straight conversation about your Nation's needs.
Whether you're evaluating IT partners, reviewing a current hosting arrangement, or beginning a digital sovereignty initiative — our team is ready to walk through your requirements and explain exactly how Aegisys supports OCAP® principles in practice.
- Free consultation — no obligation
- Plain-language explanation of your data's current jurisdiction exposure
- OCAP®-aligned infrastructure assessment
- References from First Nations clients available on request