Data Residency
What "AU resident" means here
Every server we operate is hosted in Australia. The phrase "AU resident" means the data is stored and processed on machines physically located on the Australian mainland, and is not replicated to or backed up in non-AU regions by us. Where a sub-processor offers AU-region services, we use them.
Where each piece of data lives
| Data | Where | Provider |
|---|---|---|
| User accounts (auth, profile) | Sydney (ap-southeast-2) | Supabase |
| Case notes (cloud mode) | Sydney | Supabase |
| Audit log | Sydney | Supabase |
| Pre-rendered question audio | Sydney region | Cloudflare R2 |
| Marketing site, web app | Cloudflare global CDN; primary AU region | Cloudflare Pages |
| AI drafting (Azure OpenAI) | Australia East | Microsoft Azure |
| AI drafting (Vertex Gemini) | australia-southeast1 (Sydney) | Google Cloud |
| AI drafting (on-device) | Your phone | Gemma 4 via llama.rn |
| Speech-to-text | Your phone | Apple SFSpeechRecognizer / Android SpeechRecognizer / Web Speech API |
What does NOT leave Australia
- Case note content. Stored only in Sydney; encrypted in transit (TLS 1.3) and at rest (AES-256).
- Voice / audio. Speech-to-text runs entirely on your device. Audio is never transmitted off the device.
- AI prompts (when using Azure or Vertex). Both providers are configured to their AU regions. Inbound prompts are stripped of common Australian identifiers (names, AU phone numbers, dates, addresses, Medicare/ABN/NDIS numbers, emails) on a best-effort basis before they leave the device, and re-stripped server-side as defence-in-depth.
What may leave Australia (and how to opt out)
Two telemetry sub-processors may transmit metadata outside Australia:
- Sentry — crash reports and error stack traces. Region: [SENTRY_REGION].
- PostHog — anonymised usage events (no content). Region: [POSTHOG_REGION].
Telemetry is on by default but can be disabled by your organisation's admin (Settings → Privacy → Telemetry) or by writing to [PRIVACY_CONTACT_EMAIL]. Disabling telemetry has no impact on the Service's operation; it just means we have fewer signals for diagnosing crashes and improving the product.
Why this matters for ACCHO, NDIS, and government deployments
For Aboriginal Community Controlled Health Organisations (ACCHOs), NDIS providers, and government departments, AU data residency is often a contractual requirement. Case Flow's design is to satisfy that requirement by default — you do not need to enable any setting or sign a special agreement to keep your data in Australia.
Our compliance memo at docs/compliance/app11-mapping.md details the controls we have in place against APP 11 (Security of personal information). It is available to procurement reviewers on request to [PRIVACY_CONTACT_EMAIL].
Removed providers
We previously evaluated providers that did not meet the AU-residency posture. Those have been removed:
- Alibaba Qwen (DashScope) — removed 2026-04-22. Hosted on PRC infrastructure.
- Mistral Voxtral as a runtime call — removed 2026-05-09. Hosted in France. Replaced by an operator-side prebuild that generates question audio once on a developer's machine; the resulting MP3s are then served from Sydney R2.
Changes to data residency
If we ever change a sub-processor's region or add a new sub-processor outside Australia, we will:
- Notify enterprise customers in advance per the Data Processing Agreement;
- Update this page with the new effective date;
- Provide an opt-out where the change affects user-identifiable telemetry.
Questions
For procurement enquiries about data residency, write to [PRIVACY_CONTACT_EMAIL] or [SUPPORT_EMAIL].