IT for municipalities and regional districts.
A local government the size of a mid-Island town runs more systems than a business ten times its revenue, under rules no business has. Records are statutory, purchasing is public and meetings are on the record. We build and run IT that holds up under all three.
Municipalities, regional districts, and the boards and commissions attached to them.
- Sign-in blocked, all sessions revoked9:14 am
- Mailbox converted to shared, office manager given access9:16 am
- Licence removed, back in the pool9:21 am
- Records you can find when a request lands
- Bought through your process, not around it
- Every account in the local government's name
- A change log you can read
Same size as a mid-market business. Different rules entirely.
Three constraints separate a local government from a company with the same number of desks. None looks like a technology problem on the day it shows up. Each was decided years earlier by an IT choice nobody flagged.
Retention is an IT decision made early.
Defensible beats convenient.
The chamber is part of the bylaw.
Never one network. Usually six, across four buildings.
City hall, the works yard, the arena or pool, the fire hall, sometimes a water plant or landfill, and a library that may or may not be yours to support. Different buildings, links, hours and people, on one small IT budget. We map all of it before quoting any of it.
Finance, tax and utilities
The financial system, property tax, utility billing, front-counter receipting and the card processing behind it. The only system here whose outage has a public queue in front of it, and the only one carrying payment card industry obligations on top of statute. Its upgrade windows are set by the vendor and the tax cycle, so finance work goes in the calendar a year out.
Planning, permits and bylaw
Permit intake, inspections, bylaw files and the applicant-facing side that increasingly runs online. Mostly a document problem dressed as an application: drawings, correspondence and decisions all have to be findable years later by someone who was not there and is answering a lawyer.
Public works and the yard
Work orders, fleet, asset management and the operational systems attached to water and wastewater. Those last ones get their own conversation and their own answer. They are not office IT, they do not patch on an office schedule, and treating them as office IT is how a utility ends up exposed.
Recreation, facilities and the library
Bookings, memberships, point of sale at the desk, public wifi and public access computers. The public network belongs nowhere near the corporate one, and in many small local governments it is still one flat network nobody has touched since the building opened.
Fire, emergency and after hours
Paging, the emergency operations centre, the call-out list, and what still works when the power is out, the office is closed and the highway is shut. This is where an IT failure stops being an inconvenience, so it gets scoped in writing like everything else.
Records, FOI and the clerk's office
The corporate records system, the retention schedule, the agenda and minutes pipeline, and a search that has to work the day a request arrives. This office finds out first whether the rest of the estate was set up properly, and it finds out with a clock running.
The rule changed in 2021. It did not go away.
Every BC local government is being asked this right now, usually by a vendor with a Copilot licence to sell, and the change is routinely described as a relaxation. The obligation moved. It did not lift.
Municipalities and regional districts are local public bodies under British Columbia's Freedom of Information and Protection of Privacy Act. Until late 2021 the Act carried a hard data-residency rule: personal information in a public body's custody or under its control had to be stored in Canada and accessed only from Canada, with narrow exceptions. That is the rule most people still have in mind when they say FOIPPA will not let them, and it is the rule that made a straightforward move to a cloud platform difficult for the better part of a decade.
Bill 22 came into force on 25 November 2021 and repealed those provisions. Disclosure of personal information outside Canada is now handled through the Act's ordinary disclosure rules rather than through a blanket prohibition. What replaced the prohibition is an assessment obligation. A privacy impact assessment is required for initiatives that touch personal information, and where sensitive personal information will be stored outside Canada a supplementary assessment forms part of it. The outcome is a documented, risk-based decision taken by the head of the public body.
The practical shift, plainly: the old rule was a line. Inside Canada or not at all, the same answer for every system. The new rule is a file. You may do it, and you must be able to show afterwards why it was acceptable for this system, this data, at this time. So for us the deployment and the paperwork are one job. Configuring a tenant and leaving the assessment to someone else produces a live system and a decision nobody made, which is the worst outcome available and the most common.
Two different things also get collapsed into one word here. Residency is where the bytes are, and the major platforms run Canadian regions and publish which services keep data inside them. Sovereignty is whose law can compel access, and a Canadian data centre run by a US-headquartered company does not settle that half, because US law reaches data under a US provider's control wherever it sits. Both are true at once. Neither is a reason to refuse the platform or to skip the assessment. A vendor who only tells you the first half is answering a smaller question than the one you asked.
Microsoft 365 Copilot is where this lands in practice. It is switched on per licence and reads whatever the person prompting it can already reach. That is the real exposure, and it is a permissions problem, not a privacy-law one. An assistant that can search everything a user can will surface the HR folder someone shared with the whole organisation in 2019, in front of whoever asked. So the order is permissions first, assessment second, licences third. Done the other way round, it produces the incident in the local paper and an assessment written afterwards to explain it.
Underneath all of it is solid managed IT: monitored and patched machines, Microsoft 365 administration, endpoint protection, backups with a restore that has actually been run, and a network that reaches every site. Same work as on the managed IT page . The difference here is that every decision gets written down in a form that survives an audit, a change of council, and a request from a member of the public.
Buy it the way you are required to. We bid the same way.
Vendors lose public work by treating procurement as an obstacle, and staff pay for it afterwards. These commitments go in writing, and none of them costs you anything.
Below the threshold
- Quoted in writing, with scope, exclusions and term stated on the page
- Priced in the same units as the other quotes, so a comparison is possible
- No bundle assembled to make a like-for-like comparison impossible
- No pressure to treat it as a sole source when it plainly is not one
Above the threshold
- Posted openly, which for BC local government means BC Bid, and covered notices carry through to CanadaBuys
- Questions answered in the open, to every bidder, not privately to us
- A response written to your format rather than replacing it with ours
- No certification, clearance, reference or experience claimed that cannot be checked
Written into the agreement
- Which systems are covered, and what is quoted separately
- Who owns the tenant, the domain and the data, which is always the local government
- What happens at the end of the term, including who performs the export
- The record of what was changed and when, held by you rather than only by us
Councils change. The estate does not.
A general local election every four years resets the council or board, and with it the appetite for a capital request already deferred twice. The systems do not reset, and neither does the year the switches lose support. What carries an estate through that is three documents: a written inventory of what exists and what it costs to keep, a replacement schedule with real dates, and a one-page answer to what stops if each system stops. A new council can read those in an evening. We write them and keep them current.
Whoever provides the service.
Three things a local government should be able to produce on request, whoever runs its IT. If any of them takes a call to a vendor, that is the finding.
- The tenant and the domainRegistered to the local government, with your own staff holding the top administrator accounts.
- The retention recordWhat is kept, where it lives, for how long, and who can search it on the day a request arrives.
- The exitA written process for taking everything back, rehearsed at least once, not drafted at the end.
Before anything is procured
The questions staff ask first, answered the way we answer them in a meeting.
Does FOIPPA still stop us using cloud services?
No, and it has not since late 2021. The Act used to require that personal information in a public body's custody or control be stored and accessed only in Canada. Bill 22 repealed that. In its place is an assessment obligation: disclosure outside Canada runs through the Act's general disclosure rules, a privacy impact assessment is required, and where sensitive personal information will be stored outside Canada a supplementary assessment goes into it. The result is a documented, risk-based decision by the head of the public body.
Who is responsible for the privacy impact assessment?
The public body. That responsibility never transfers to a vendor. What we contribute is the technical detail the assessment needs and cannot invent: which service holds which data, where it is stored, who can reach it, what is logged, how long it is kept and how access ends. The decision and the signature stay with the head of the public body, where the Act puts them.
Can you help with an FOI request?
With the search and extraction, yes. Finding every matching record across mail, file shares, a records system and anything else the request touches is technical work, and it is the part that runs out of clock. What gets released and what gets severed stays with the head of the public body and their delegate.
Our council meetings are streamed and it keeps failing. Is that IT?
Yes, and we treat it as a statutory system, not audio-visual kit. Open meeting requirements sit in the Community Charter and the Local Government Act, and where a procedure bylaw allows electronic participation the public still has to be able to hear, or watch and hear, the proceedings. That makes the microphones, encoder, network path and recording a compliance dependency. The fix is usually one documented signal path, a tested fallback, and someone who knows what to do in the first two minutes.
We already have internal IT. What would you actually do?
Work with them, not around them. Usually internal staff hold the counter and the departments, and we cover what a small team cannot reasonably carry: extra hands during a project, the systems nobody has had time to learn, and a straight second opinion on a vendor proposal. The split goes into the agreement, so nobody is working it out during an incident at eleven at night.
Do you work with regional districts as well as municipalities?
Yes, and the difference is real. A regional district is a federation. It delivers different services to different electoral areas and member municipalities, its budget comes from separate service areas, and its board is made of representatives who each answer somewhere else. On the Alberni-Clayoquot Regional District board, four treaty First Nations sit as full voting members alongside three member municipalities. A board like that changes how a shared system handles access and records, so we treat it as a design question.
Tell us what the estate actually looks like.
Which systems, which buildings, and which ones nobody wants to touch. We come back with the shape it is in and what fixing it takes, in writing, before any term is discussed.
Book a call