When we tell government buyers their data will never leave Australia, we mean it at every layer — not just the database, but the CDN, the email system, the backup infrastructure, and the observability pipeline.
Melbourne primary, Sydney warm standby
Our primary infrastructure runs in Melbourne. Our disaster-recovery warm standby runs roughly 700 km away in Sydney, NSW — a separate state, power grid and ISP — replicating synchronously, with a third Australian site providing the quorum tiebreaker so the cluster can never split-brain. Automatic failover is tested at around 16 seconds on average, and point-in-time recovery covers a full 365 days. No Singapore failover, no US-West-2 fallback. If the primary goes down, traffic routes to the standby — still in Australia, still under Australian jurisdiction.
This is a deliberate constraint. Offshore multi-region architectures are cheaper to assemble. But for government data, jurisdictional certainty outweighs architectural convenience — so we built the geographic redundancy inside the border instead.
Encryption at every layer
Data at rest is encrypted with AES-256-GCM. Data in transit uses modern TLS (1.2+, preferring 1.3). Encryption keys are managed within Australian infrastructure and rotated on a defined schedule.
Row-Level Security enforces tenant isolation at the PostgreSQL engine level. This means a query from one council physically cannot return another council’s data, regardless of application bugs. The isolation is mathematical, not just contractual.
Why it matters for procurement
Victorian councils operate under the Local Government Act 2020 and the Victorian Protective Data Security Standards (VPDSS). Storing compliance data — which often includes employee training records, incident reports, and psychosocial health surveys — on foreign infrastructure creates legal and political risk.
By keeping everything in Australia, we simplify the procurement conversation. There’s no data processing agreement to negotiate with foreign cloud providers, no GDPR cross-border transfer assessment, no ministerial briefing about offshore data handling.
Security testing and audit
We run a continuous, internal, AI-augmented adversarial security-testing program — repeated cycles of reconnaissance, vulnerability analysis, live exploitation verification, remediation and re-validation — alongside nightly automated dependency-vulnerability scanning that gates every release. Detailed assessment reports map our attack surface, so they are treated as confidential; executive summaries and full reports are available to customers under NDA. For government and enterprise engagements, we commission an independent accredited penetration test as a contracted deliverable.
The immutable audit trail retains 36 months of data by default. Every action — every login, every record change, every export — is logged append-only behind a tamper-evident, Certificate-Transparency-style Merkle log whose signed tree heads are anchored off-database. This means audit evidence isn’t just available; it’s provably unmodified.
Insurance and credentials
We carry $10M Professional Indemnity and $20M Public Liability insurance. We’re members of the Australian Computer Society. We’re aligned with ISO 27002 controls, with ISO 27001 certification on our roadmap.
These aren’t badges for a marketing page. They’re the baseline expectations of government buyers, and meeting them from day one was a deliberate choice. For more on how this infrastructure supports sensitive compliance data — including psychosocial health surveys and incident competency snapshots — see our module deep-dives.