Data Residency
What “AU resident” means here
Every server we operate is hosted in Australia. Your data is stored and processed on machines physically located on the Australian mainland, and we do not replicate or back it up to any non-AU region. Where a sub-processor offers an Australian region, we use it.
Where each piece of data lives
| Data | Where | Provider |
|---|---|---|
| User accounts (auth, profile) | Sydney (ap-southeast-2) | Supabase |
| Case notes | Sydney | Supabase |
| Audit log | Sydney | Supabase |
| Pre-rendered question audio | Sydney region | Cloudflare R2 |
| Marketing site, web app | Cloudflare CDN; primary AU region | Cloudflare Pages |
| AI drafting | Australia East | Microsoft Azure OpenAI |
| AI drafting | australia-southeast1 (Sydney) | Google Vertex AI |
| AI drafting (optional, offline) | Your phone | On-device model |
| Speech-to-text | Your phone | Built-in iOS / Android / browser recogniser |
What never leaves Australia
- Case note content. Stored only in Sydney, encrypted in transit (TLS 1.3) and at rest (AES-256).
- Voice and audio. Speech-to-text runs on the device where your phone or tablet supports it; where it does not, your device platform’s own speech service (Apple’s or Google’s) transcribes it under that platform’s terms. Either way the recording is discarded after transcription, and the audio is never sent to Flow Outcomes, never stored on our infrastructure, and never used for AI drafting.
- Everything sent for AI drafting. Both cloud providers are pinned to their Australian regions (Azure Australia East and Vertex AI Sydney), so note content is drafted on Australian soil. We do not alter or de-identify what a practitioner records: the note is protected by where and how it is processed, not by changing what is written in it.
The sub-processors that operate outside Australia
No case note, transcript, client record or wellbeing check-in leaves the country. Three services do run overseas, and none of them receives client content. We name them because Australian Privacy Principle 8 requires us to, and because a reviewer should be able to see the whole picture:
- Sentry: crash reports and error traces, stored in the United States. Sentry offers only US and EU regions; there is no Australian option from this provider. Note content, transcripts, client names, participant names and email addresses are stripped before an event is sent. What travels is the error message, the code path, and an anonymous identifier with the person’s role. Your admin can switch it off entirely under Settings → Privacy → Telemetry, or by writing to us. Disabling it changes nothing about how the app works.
- Resend: transactional email (invitations, note links and reminder digests). Delivery logs are stored in the United States; Resend does not offer Australian residency. An email carries the recipient’s address, the organisation’s name and the sender’s name. Reminder digests deliberately carry a count and a link, never note text. This one cannot be switched off, because it is how invitations and note links reach people.
- Stripe: payment and subscription processing, United States and global, through an Australian entity. Stripe sees the billing details needed to take payment from your organisation. It never receives case notes, client records or any practitioner content.
Australian privacy law does not require every processor to sit in Australia. It requires us to name them, to take reasonable steps to ensure they handle personal information consistently with the Privacy Act, and to remain accountable for them. That is what this page is for.
Why this matters for ACCHO, community services and government deployments
For Aboriginal Community Controlled Health Organisations, community services providers and government departments, Australian data residency is usually a contractual requirement rather than a preference. CaseFlow Note meets it by default. There is no setting to enable and no special agreement to sign to keep your data in Australia.
Our mapping of the controls we hold against Australian Privacy Principle 11 (security of personal information) is available to procurement reviewers on request.
If this ever changes
If we change a sub-processor’s region, or add a new one outside Australia, we will:
- Notify enterprise customers in advance, per the Data Processing Agreement;
- Update this page with a new effective date;
- Provide an opt-out wherever the change affects user-identifiable telemetry.
Questions
For procurement enquiries about data residency, write to [email protected].