AI Workbench

Jurisdictional control

Foreign compelled-disclosure laws apply without effective mitigation, or the ownership and sub-processor chain is unknown.Foreign legal exposure remains, but legal, contractual, or operational measures reduce its impact.Ownership, control, or technical safeguards substantially limit meaningful foreign access. The remaining exposure is documented.Access requires Canadian authorization, or verified technical safeguards prevent providers from accessing protected data and metadata.

Data portability

There is no complete, usable export of the organization's data.Export is possible, but proprietary formats, access limits, or conversion make migration a substantial project.Valuable data is available through documented APIs or widely supported formats. A practical migration path exists.Complete exports and restoration to another provider are routinely tested and can finish within one day.

Infrastructure portability

Core functions depend on one provider's proprietary infrastructure, with no credible migration within one year.Core proprietary dependencies remain, but migration is feasible within several months.Core functions support alternative hosting, with a credible migration path measured in weeks.All core functions support multiple providers. The organization can change hosting on demand.

AI provider portability

Core AI functions require one provider, with no credible migration within one year.One provider supplies core AI functions, but migration is feasible within several months.Standard interfaces support a provider change within weeks.The organization can change AI providers on demand without redesigning the service.The service does not use AI.

Operational continuity

There is no credible plan to restore or replace the service after a major disruption.A documented recovery path exists, but it takes months or depends on untested assumptions.The organization can restore or replace the service within weeks using documented dependencies and procedures.Tested procedures, available source code, and controlled dependencies support restoration or redeployment on demand.