Note that as far as the Federal Government knows the Patriot Act has never been used to access Canadian data. Consider also that your customer's data is far more secure on Microsoft's or Google's servers than it ever will be on their own server in their own office.
My editorial opinion is that ensuring you have secure passwords is far more important than being concerned about the very remote possibility that the U.S. government might access your data. 1 in 3 Canadian jobs is related to international trade; to require the data to be located in Canada limits a business' opportunity to utilize the best solution at the best price and makes us less competitive in the global market.
Would you be willing to pay 5 to 10 times more for the same service in Canada? I did the costing analysis with 2 large SaaS companies and that was the reality of the numbers.
For further reading: