Trust › Data Residency
Data Residency
Last updated: 23 September 2026
For Australian regulated industries, including NDIS providers, AML/CTF reporting entities, and accounting practices, knowing where your data lives is not optional. This page covers the main systems that touch customer data, where each is located, and why. A fuller list is available on request.
On this page
Why Data Residency Matters
Australian Privacy Principle 8 (APP 8) requires organisations to take reasonable steps to ensure overseas recipients handle personal information consistently with the APPs before any cross-border disclosure occurs.
For NDIS registered providers, the NDIS Practice Standards and the NDIS Act 2013 impose obligations around the security and appropriate handling of participant records, which include health and disability information. For AML/CTF reporting entities, AUSTRAC expectations include maintaining the integrity and confidentiality of transaction monitoring records.
Some of our applications are hosted in Australia. For custom development and workflow review engagements, residency requirements are agreed with each client in writing, as part of the Discovery Agreement or statement of work for that engagement. The table below sets out, product by product, where each system that processes customer data is actually located.
Where Your Data Lives
Each of our products has its own infrastructure. The tables below set out, product by product, the main systems that process customer data, where each is located, and the nature of that processing. A fuller list is available on request.
CoordHub
Primary database (PostgreSQL), authentication, file storage
Sydney, Australia (AWS ap-southeast-2)
All CoordHub customer records, user accounts, and uploaded documents.
Application hosting, serverless functions, edge CDN
Sydney, Australia (Vercel syd1) for compute; global edge network for static caching
Serverless functions and server-rendered pages are pinned to execute in Sydney, the same region as the database. Static assets (HTML, JS, CSS, images) are additionally cached at edge nodes worldwide for performance; these contain no customer data.
Error monitoring
Region not confirmed here
Used to capture application errors for debugging.
Product analytics
United States
Used to understand feature usage.
Transactional email delivery
Region not confirmed here
Used for account and transactional email.
Payment processing, subscription billing
Global (primary infrastructure in the US)
Background job and workflow orchestration
Region not confirmed here
Accounting integration, when a provider connects their own Xero account
Region not confirmed here
Address geocoding for the provider directory
Region not confirmed here
RedRock PM
Primary database (PostgreSQL), authentication, file storage
Sydney, Australia (AWS ap-southeast-2)
Per-organisation envelope encryption key management
Sydney, Australia (ap-southeast-2)
Confirmed directly against RedRock PM's own code: a separate encryption key is generated per organisation and wrapped through AWS Key Management Service in the Sydney region.
Nightly database backups
Sydney, Australia
Application hosting, serverless functions
Sydney, Australia (Vercel syd1)
Confirmed in our Vercel project settings, 23/09/2026.
Client-facing email delivery, when the firm has connected its own account
Set by each client's own tenant
Client-facing emails go through the firm's own Microsoft 365 account when the firm has connected one.
System emails (reminders, invitations, billing notices), and client-facing email when a firm hasn't connected Microsoft 365
Region not confirmed here
Used for system emails such as reminders, invitations and billing notices, and for client-facing email when a firm hasn't connected Microsoft 365.
Error monitoring, configured not to send default personal data, with a filter that redacts tax file numbers, email addresses, phone numbers and ABNs from error reports
Region not confirmed here
E-signing
Australia
Annature is an Australian e-signature provider.
Payment processing, subscription billing
Global (primary infrastructure in the US)
Background job and workflow orchestration
Region not confirmed here
Rate limiting
Region not confirmed here
Accounting integration, when a firm connects their own Xero account
Region not confirmed here
This website
Receives website enquiries sent to hello@redrocksystems.com.au
Mailbox data region not confirmed here
Delivers contact form enquiries to our mailbox
Tokyo, Japan (ap-northeast-1)
Application hosting, serverless functions, edge CDN
Sydney, Australia (Vercel syd1) for compute; global edge network for static caching
Custom development and workflow review work
Payment processing, billing, subscription management
Global (primary infrastructure in the US)
Handles payment card data directly. PCI DSS Level 1 (per Stripe's published certification). We pass your billing name and amount to Stripe; we do not store raw card numbers.
AI-assisted processing of materials you provide, to help draft or analyse documents during a workflow review or custom development engagement
United States
Used only under the written Discovery Agreement for that engagement, and only with your consent.
Our Commitment
We describe each system's region accurately. CoordHub and RedRock PM each store their primary customer data in Supabase PostgreSQL in the AWS Sydney region (ap-southeast-2). Where a system's region is not confirmed, we say so above rather than assume it matches the database region, and we update this page if that changes.
Custom work is agreed in writing. For custom development and workflow review engagements, residency requirements are agreed with each client as part of the written Discovery Agreement or statement of work for that engagement, not assumed from this page.
Cross-border transfers are documented. Cross-border data flows are listed in the tables above and in our Privacy Policy under APP 8. For most sub-processors we rely on the provider’s own standard terms of service, rather than a bespoke data processing agreement negotiated with each one.
APP 8 Compliance Steps
Before disclosing personal information to each overseas recipient, we take the following steps to satisfy APP 8:
- Review the sub-processor's privacy policy and, where the provider offers one, its data processing agreement or standard contractual clauses
- Disclose the cross-border flows on this page and in our Privacy Policy
- Periodically review each sub-processor's compliance certifications (e.g., Stripe's PCI DSS Level 1, Vercel's SOC 2 Type II)
Questions about data residency? hello@redrocksystems.com.au · REDROCK SYSTEMS PTY LTD · ABN 53 696 760 433