GST/HST and QST on managed security services, including foreign and USD-billed providers

Managed security services, MDR, SOC monitoring, vCISO advice and penetration tests are generally taxable supplies in Canada. A provider registered for GST/HST charges 5% GST or the HST rate of the participating province where the supply is made, and in Quebec also 9.975% QST. If your business is a GST/HST registrant and uses the service in its commercial activities, you can usually recover that tax as input tax credits (and QST as input tax refunds), so the real cost is the pre-tax fee. Foreign providers are a special case: some register under the simplified regime for digital services, some do not register at all, and the paperwork you need to recover tax differs. Budget the invoice total for cash flow, and the pre-tax amount for cost.

This guide is part of managed cybersecurity service pricing in Canada. It is general information, not tax advice.

Rates you will see on invoices

Which rate applies is decided by the place-of-supply rules, which for many services depend on the address of the customer and where the service is performed or used, not simply on where the provider is located. A multi-province business may see different rates on different invoices. Confirm with the provider and your accountant, and check the CRA's "which rate to charge" guidance.

Provincial sales tax on software and services

In the GST-only provinces, provincial sales tax can also apply to parts of a security bill:

• British Columbia applies 7% PST to software, and the definition has included software-as-a-service since 2024. Hardware such as firewalls is also taxable goods. Whether a pure managed service is caught depends on how the supply is structured; ask for the invoice to separate software, hardware and service.
• Saskatchewan PST can apply to computer services and software; check the current bulletin.
• Manitoba retail sales tax has applied to cloud computing services, including SaaS, since 1 January 2026 (Bulletin RST 033); check Manitoba Finance's bulletin for the final rules.

PST is generally not recoverable like GST/HST, so it is a real cost. Keep it in the budget.

Use the tax-inclusive calculator

The sales-tax-inclusive price calculator adds the rate to a fee.

Worked example. A Quebec City business is quoted $2,800 a month for MDR. Tax = $2,800 × 14.975% = $419.30; invoice total = $3,219.30. Over a year, the invoices total $38,631.60, of which $5,031.60 is GST and QST. As a registrant using the service in commercial activities, the business can usually claim back $1,680 of GST ($2,800 × 5% × 12) and $3,351.60 of QST ($2,800 × 9.975% × 12).

Partly exempt businesses. A business that makes exempt supplies, such as many financial services, residential rents or some health services, may not be able to recover all of the tax. For them, the tax-inclusive figure is closer to the real cost. Ask your accountant how your recovery rate is calculated.

Foreign and USD-billed providers

Many security tools and some MDR services are sold by providers outside Canada.

• Registered under the normal regime: they charge GST/HST (and QST if registered in Quebec) and issue invoices with their registration number. You claim input tax credits as usual.
• Registered under the simplified regime: since 1 July 2021, non-resident vendors of digital products and services to Canadian consumers may register under a simplified GST/HST framework. The CRA's Notice 322 explains that tax collected by a simplified registrant generally cannot be claimed as an input tax credit. A registered business should give the vendor its GST/HST registration number so the vendor does not charge the tax in the first place. Quebec has a similar specified QST registration.
• Not registered: no tax appears on the invoice. A business that acquires the service exclusively for its commercial activities generally does not self-assess GST/HST on an imported taxable supply. If your use is not exclusively commercial, self-assessment may be required. Ask your accountant.

For services billed in US dollars, the tax is calculated on the Canadian-dollar value. The exchange rate also changes your cost; see renewal uplifts and USD pricing.

What a proper invoice should show

To claim input tax credits, keep invoices that show the information the CRA requires for the invoice amount, including the supplier's name and GST/HST registration number on larger invoices, the date, the amount and the tax charged or a statement that it is included. Ask the provider to show tax on each line where some lines are taxable and others are not, and to separate hardware, software licences and services.

Checklist for the finance team

• Record each provider's GST/HST and QST registration numbers and check them in the CRA and Revenu Québec registries.
• For foreign vendors, record whether they are normal, simplified or unregistered.
• Give your own registration number to simplified registrants.
• Separate PST-able hardware and software from services in BC, Saskatchewan and Manitoba.
• Budget invoice totals for cash flow and pre-tax amounts for cost.
• Use the pre-tax amounts in the cost estimator and worked examples.

Frequently asked questions

Is a penetration test taxed differently from monitoring?

Generally no; both are taxable services. Place-of-supply rules decide the rate, especially if testers work from another province.

Do small businesses below the threshold pay GST on these services?

Yes, they pay tax charged by registered providers. A business not registered (for example a small supplier below the $30,000 threshold that has not registered voluntarily) cannot claim input tax credits, so tax is a real cost for it.

Does a USD invoice change the tax rate?

No. The rate depends on the supply, not the currency, but the Canadian-dollar base changes with the exchange rate.

Is cyber insurance premium subject to GST/HST?

Insurance is generally an exempt financial service for GST/HST, but some provinces charge premium taxes or sales tax on insurance. Ask your broker.

Sources

• Canada Revenue Agency — GST/HST rates, place of supply, input tax credits, Notice 322
• Revenu Québec — QST and specified registration
• Government of British Columbia — PST on software
• Justice Laws Website — Excise Tax Act