Managed IT in Victoria, for a buyer with a shortlist.
Valley Edge is in Port Alberni, about three hours up the highway. Victoria has more IT providers per business than anywhere else on this Island. So this page is not written to convince you that local is better. It is written to give you three things to compare, and to name the two jobs where somebody down there is the right hire and we are not.
Remote-first, no Victoria office, and the drive stated in full below
- One address, and it is not here
- Tenant, licences and domain in your name
- Exclusions written down, not implied
- A review that can conclude your current provider is fine
You are the one buyer on this Island who already has a shortlist.
Most communities up-Island have two or three providers and somebody's nephew. Victoria has an actual market: national managed service providers with downtown offices, mainland firms that fly a technician over, and shops that were working on Douglas Street before this business existed. Being told "we are local, we care more" by a fourth voice is worth nothing to you. What follows is the part that is worth something.
Four things are true here that are not true up-Island.
Victoria is the seat of the provincial government, and that fact reaches a long way down into businesses that have nothing to do with government. It changes what a small firm's IT has to be able to prove, and proving things is a different job from keeping them running.
01 · A lot of your clients answer to a statute
Ministries, crown corporations, health authorities, school districts, First Nations governments and the consultancies that serve them are concentrated here in a way they are nowhere else in the province outside the Lower Mainland. If any of them is your client, their obligations arrive in your contract as a privacy schedule, a security questionnaire or a demand for a privacy impact assessment. That paperwork is not really asking whether your IT works. It is asking whether you can describe it accurately in writing, which is a thing almost no small firm can do on request and almost every small firm could do with a fortnight of unglamorous work.
02 · The data residency question changed, and did not go away
British Columbia amended the Freedom of Information and Protection of Privacy Act in November 2021 and repealed the requirement that a public body store personal information inside Canada. The obligation did not evaporate; it moved into contracts, privacy impact assessments and internal policy. So the live question stopped being "is this legal" and became "what did we agree to, and can we show where the data actually sits". The second half is answerable in an afternoon and almost nobody has been asked.
03 · Professional bodies land on IT before regulators do
Law, accounting, engineering, architecture and land surveying are all thick on the ground here. None of their governing bodies publishes an IT policy, and all of them produce IT consequences: who may read a client matter, how long a file is kept after the work ends, what happens to it when a partner leaves, and whether a given cloud service may hold it at all. These are configuration decisions wearing professional clothing.
04 · The workforce arrives in April and leaves in October
Tourism, hospitality, the cruise and conference calendar and the legislative session give this city a hiring rhythm the rest of the Island does not have at the same scale. Onboarding always gets done, because somebody cannot start without a login. Offboarding is the list nobody finishes, and a live account belonging to a person who left in the autumn is the most ordinary way a small business here is breached.
05 · Your staff can be poached by a bigger IT budget
The capable person who has been quietly holding your systems together is, in this city, one recruiter away from a government or a tech salary you cannot match. Everywhere else on the Island that risk is theoretical. Here it is a Tuesday. It is also the single best argument for writing down what you own and how it is configured while that person still works for you.
Three questions. Ask all four of us the same ones.
Every provider you are talking to, this one included, will sound similar for the first twenty minutes. These three questions separate them by the second, and none of them is about technology.
Who replies, and what may they change?
Not "what is your response time" — that is a number anyone can print. Ask who sends the first reply, whether that person can change a setting themselves or has to escalate to somebody who can, and how many hands a password reset passes through. A large provider answers quickly and acts slowly, because the first contact is not permitted to touch anything.
Ask for the name of the person.
What do you own if this ends badly?
The Microsoft 365 tenant, global administrator rights, the domain registration and the account it sits in, the backup and whether it can be exported in a usable form, and the documentation describing how any of it was configured. Ask to see the clause. Ownership that exists only in a sales conversation is not ownership, and the moment you need it is the moment the relationship is already bad.
Ask for the clause, not the reassurance.
What is explicitly not covered?
The exclusions are the contract. A provider who cannot list them quickly has either not thought about it or would rather you found out later, and both cost the same. Line-of-business software the vendor supports, physical cabling, printers on a lease, telephony, and anything a third party has to be present for are the usual ones, and the honest answer names them without being pushed.
A vague exclusion list is the finding.
About three hours, and a Malahat.
The route is Highway 4 to the Island Highway and then south. It is a real constraint, it is not going to be argued away, and pretending otherwise on a page read by people who drive it would be insulting.
Start with what the drive does not touch. Identity and access, Microsoft 365, mail flow and licensing, patching, endpoint protection, backup configuration and restore testing, permissions, offboarding, documentation and the whole audit-and-answer job described further up this page are done over a connection. A provider standing in your reception cannot do any of them faster than one sitting in Port Alberni, and most of the time they do them from a desk too.
Now the part that is genuinely worse. If your building has a comms room that needs hands on it most weeks, hire somebody in Victoria. If your operation stops dead when a specific machine stops and somebody has to be physically in front of it inside the hour, hire somebody in Victoria. Those are not edge cases and they are not solved by a good attitude about driving. There are providers down there who will be at your door in twenty minutes, and if that is the thing you are actually buying, buy it from them.
What is left is a large and unfashionable middle: a business whose computers are laptops, whose server is a subscription, whose real exposure is a tenant nobody has audited since it was set up and a backup nobody has ever restored from. That business is the majority of professional Victoria, and for it the location of the provider is close to irrelevant while the attention of the provider is close to everything.
On-site is booked rather than promised, and it is booked for the things that are genuinely physical. A day in Victoria is a day, not a call-out, so it gets planned against work that is worth a day: a migration cutover, a proper inventory of what is actually in the building, a handover from a previous provider where somebody needs to open cupboards. Anything that can be done without driving is done without driving, which is not a compromise but the same order of operations any competent provider three blocks away uses.
What a managed agreement covers, tier by tier, is set out on the main managed IT page: managed IT and support across Vancouver Island, and the geography behind it is on the Vancouver Island coverage page.
Two of these cards send you somewhere else.
A managed agreement is a poor fit more often than the industry admits, and finding that out in month seven is expensive for both sides. Here is the honest split, and underneath it the list of claims this page does not make.
- Cloud-first: laptops, Microsoft 365, and little or nothing in a rack
- A professional or advisory firm that has outgrown whoever was good with computers
- A business that has to answer a client privacy schedule and currently cannot
- An operation with an inherited setup nobody has documented or audited
- Somewhere the real risk is the mailbox, not the machine room
- A comms room or physical estate that needs hands most weeks
- An operation that stops when one machine stops and needs somebody in front of it inside the hour
- A manufacturing floor, a lab or a broadcast setup with equipment on site
- A procurement process that requires a supplier with a local office, which is a checkbox, not an argument
- The tenant, the domain and every licence stay in the business name
- Scope and exclusions written down before anything starts
- Work outside what we do is named on the call, not three weeks in
- A review is allowed to conclude that your current provider is doing fine
- Nothing of yours is held if the relationship ends
- No office, no local number and no technician living in Victoria
- No response-time figure until one exists in a signed agreement
- No monitoring hours, because the honest ones are not stated yet
- No certification, partner tier or vendor badge, because none is verified here
- No Victoria client named, no review count, no uptime percentage
Before you shortlist us
The six questions a Victoria buyer actually opens with, answered the same way here as on the phone.
Do you have an office in Victoria?
No. There is one address and it is in Port Alberni. Nothing on this page claims a downtown suite, a local number or a technician who lives here, because a buyer can check all three in about a minute and the page would be finished.
Then why would we hire someone three hours up the highway?
Only for the work where the highway is irrelevant. A Microsoft 365 tenant nobody has audited, a backup nobody has restored from, licensing that has quietly drifted past headcount, offboarding that never finishes: none of that gets better because the provider is on Douglas Street. If your problem is physical and weekly, the highway is not irrelevant and you should read the section above about that.
Our client is a ministry and their contract has a privacy schedule. Can you sign it?
We read it first and tell you which obligations we can actually meet and which we cannot, before anything is signed. A provider who agrees to a schedule without reading it has given you a problem that surfaces during an audit rather than during procurement.
Our data has to stay in Canada. Is that still a rule?
It depends entirely on what you have agreed to. The blanket statutory version of that rule was repealed in 2021, and the obligation now travels in contracts, privacy impact assessments and internal policy instead. The practical work is unglamorous and finite: find out which region the tenant was created in, where the backups land, and what the retention setting actually is, then compare that with the paperwork you signed.
We already have a provider. Can you just review what they have done?
Yes, and it is a scoped piece of work with a written result rather than a sales visit wearing a clipboard. If the review finds the current provider is doing a decent job, you get told that. That answer costs the same as the other one.
Are you an approved provincial vendor?
This page makes no such claim. If your requirement is a supplier already sitting on a provincial procurement vehicle, ask that question in the first two minutes of any call, including this one. It is a hard yes or no and it saves everybody a meeting.
Send us the questionnaire you cannot answer.
A client privacy schedule, a security questionnaire, or a tenant nobody has looked inside since it was created. We will tell you what is actually true about it and what closing the gap takes.
info@valleyedgeconsulting.io · 778-488-8618