Australian data residency, disclosed cross-border flows
All primary application data sits at rest in Australian regions (database, auth, storage, rate-limit counters, compute). Every cross-border flow is enumerated and disclosed — including the one at-rest exception, the daily encrypted off-site backup held as ciphertext only. That backup's disclosure was itself completed across the register copies on 27 July 2026, after the objective flagged it as an undisclosed flow.
Standards mappings
This control maps to the following standards and frameworks. Each entry states our real relationship with the standard, and the specific requirements this control helps satisfy.
Australian Privacy Act 1988 (APPs, incl. the NDB scheme)PrivacyApplicable law
The primary legal regime. APP 8 drives the residency objective and every disclosed cross-border flow, APP 11 drives retention and erasure, and the Notifiable Data Breaches scheme's assessment clock is built into the incident runbook with OAIC contacts documented. The privacy policy, terms, and DPA template are counsel-reviewed and approved.
- APP 8Cross-border disclosure of personal information
ISO/IEC 27001:2022InfoSec complianceSelf-assessed
A full 93-control Annex A Statement of Applicability is maintained and honestly dispositioned, and the ISMS went live on 26 July 2026 with its first completed management review. Not certified: no external audit has occurred, the clause 9.2 internal audit is openly unmet, and the certification trigger (a named tender, funding, or first hire) was formally decided at the first management review.
- 9.1Monitoring, measurement, analysis, evaluation
Policy mapping
The written standard this control enforces:
Request access and we can share the full policy set, assessment reports, and completed questionnaires under NDA — or answer your security questionnaire directly.