As at 20 September 2026, 30 of the AI tools we have reviewed state an Australian storage region, or processing on hardware you control. Seven of those run on your own machine or your own infrastructure, so nothing leaves the country. The other 23 are cloud products whose vendors publish an Australian region. Almost all of that second group means storage, not processing. Among the cloud tools we have checked, only Lyrebird Health states that the AI processing itself runs in Australia. If your requirement is that your prompts are answered onshore, that distinction is the whole question, and most vendor marketing blurs it.
That paragraph is dated because it will go out of date. Vendors open regions, gate them behind Enterprise plans, and quietly change sub-processors. Every claim below is drawn from a specific review that carries its own verification date. For the long version of how this works, read our guide to AI data residency in Australia.
Residency, sovereignty, and why the words matter
Data residency is a question of geography. It asks where the bytes physically sit. A vendor with Australian data residency stores your data in a data centre located in Australia. That usually means a Sydney or Melbourne region run by AWS, Microsoft Azure or Google Cloud.
Data sovereignty is a question of law. It asks which country's courts and agencies can compel access to your data, and which country's rules govern it. Data stored in Sydney by a US-headquartered company is resident in Australia but may still be reachable under US law.
The two come apart constantly. A US vendor can give you a Sydney storage region and remain a US company subject to US legal process. An Australian-owned vendor can be genuinely sovereign and still run its servers in Oregon. If you need both, you have to ask for both, separately, in writing.
There is a third distinction that matters more for AI than for ordinary software. Storage residency is not processing residency. A tool can hold your documents in Sydney and still send every prompt to a model running overseas. Microsoft's own documentation is the clearest worked example we have found. Power BI data can sit in Australian data centres. Copilot prompts, including your schema and conversation history, are processed by Azure OpenAI in United States data centres. That is not a gotcha. It is written down, and it is the norm rather than the exception.
Why an Australian business should care
Under the Privacy Act, an Australian organisation that discloses personal information to an overseas recipient generally remains accountable for what happens to it. Australian Privacy Principle 8 requires reasonable steps to ensure the overseas recipient handles that information consistently with the Australian Privacy Principles. In most cases the disclosing organisation stays on the hook for a breach at the other end. Choosing a tool with an Australian region is one of the simplest ways to keep that exposure small.
On top of the general law sit sector rules that make the question sharper:
- Health. Patient records carry specific handling obligations, and practice software vendors are routinely asked to state where clinical data is held.
- Legal. Confidentiality and privilege obligations do not pause because a matter went into a chatbot.
- Financial services. Prudential and outsourcing expectations mean a regulated entity must be able to say where its data sits and who touches it.
- Government. Commonwealth and state buyers work to security frameworks that expect assessed providers and, for sensitive workloads, onshore hosting. IRAP assessment is the shorthand you will see in vendor marketing.
A caution on that last point: a certification is not a residency statement. ISO 27001, SOC 2 and IRAP describe how a vendor runs its security programme. None of them tells you where your data lives. We see vendors answer a residency question with a certification badge constantly, and it is not an answer.
What we checked, and what these findings are
Our residency sweep of the review corpus, built on 10 June 2026, read 165 reviews looking for a residency statement. (Housekeeping, 7 Oct 2026: the directory-wide review count was removed from this page; nothing else changed.) Every tool named on this page was then re-read against its own review on 20 September 2026 before it was listed here.
Three limits, stated plainly.
We are reporting the vendor's own statement. We have not audited anyone's infrastructure, run a packet capture, or sighted a contract. Where a review says a tool stores data in Australia, the vendor said so. It said so on a page we read and cited, on that review’s date.
Absence from this list is not a finding. It usually means we have not found a clear public statement, not that a tool stores your data offshore. Several tools below sit in the second table for precisely that reason.
Residency is often plan-gated. An Australian region may exist only on Enterprise, or only if you ask for it at contracting. Culture Amp is the clearest case here: the Australian data centre is real, and it is assigned at contracting rather than granted automatically.
Tools where data never leaves hardware you control
This is the only category where the answer is structural rather than contractual. Nothing is disclosed overseas because nothing is disclosed at all.
| Tool | Category | Score | AU Fit | What the review found | Review |
|---|---|---|---|---|---|
| LM Studio | Local / Offline & Private AI | 23/25 | 5/5 | In local mode, data never leaves your device. Cloud features exist and are opt-in | Read |
| Ollama | Local / Offline & Private AI | 21/25 | 5/5 | Data never leaves your machine; no cross-border disclosure under APP 8 | Read |
| Jan | Local / Offline & Private AI | 20/25 | 5/5 | Local execution, open source and auditable, analytics off by default | Read |
| GPT4All | Local / Offline & Private AI | 20/25 | 5/5 | Runs offline; no internet required and data never leaves your machine | Read |
| AnythingLLM | Local / Offline & Private AI | 19/25 | 5/5 | Run self-hosted, client data never leaves your own infrastructure | Read |
| Airlock Digital | Cybersecurity & Data Protection | 22/25 | 5/5 | On-premise or air-gapped deployment keeps execution and policy data onshore; the vendor-hosted cloud console does not publish its region | Read |
| Metabase | Data Analysis & BI | 19/25 | 4/5 | Self-host it on AWS Sydney or Azure Australia and your data stays in Australia; its Metabot AI feature calls an external model with your own API key | Read |
Cloud tools that state an Australian region
Every row below is a vendor statement recorded in that tool's review. Read the caveat column before you rely on any of them.
| Tool | Category | Score | AU Fit | What the review found | Review |
|---|---|---|---|---|---|
| Culture Amp | HR & Recruitment AI | 23/25 | 5/5 | Three regional data centres including Australia on AWS; the AU region is assigned at contracting, not by default | Read |
| Google Gemini | AI Assistants & Chatbots | 22/25 | 5/5 | Data centres in Sydney and Melbourne; IRAP certified | Read |
| Heidi Health | Healthcare & Medical AI | 22/25 | 4/5 | Compliance page states all data is locally hosted within Australia; the review notes it is not an absolute guarantee that nothing leaves | Read |
| Employment Hero | Legal, Compliance & HR | 22/25 | 4/5 | Help Centre states data is stored on protected servers in Australia, on AWS | Read |
| PropertyMe | Real Estate & Property AI | 22/25 | 5/5 | Primary data stored in Australia; the email component uses a US-based third-party provider | Read |
| Frollo | Personal Finance & Budgeting | 22/25 | 5/5 | Privacy policy confirms data is primarily stored in Australia; opting into Yodlee screen-scraping may process data in the US | Read |
| Microsoft Copilot | AI Assistants & Chatbots | 21/25 | 5/5 | Australian data centres in Sydney and Melbourne; IRAP certified at PROTECTED level | Read |
| Microsoft Defender for Business | Cybersecurity & Data Protection | 21/25 | 5/5 | The underlying Defender for Endpoint operates from Azure data centres including Australia | Read |
| Zoho CRM with Zia AI | Business, CRM & Sales AI | 21/25 | 5/5 | Data centres in Sydney and Melbourne; an Australian sign-up is hosted in the local region | Read |
| Lawpath | Legal, Compliance & HR | 21/25 | 5/5 | Hosted on AWS in the Australian region, with the company stating data stays within Australian borders | Read |
| Lyrebird Health | Healthcare & Medical AI | 21/25 | 5/5 | Transcription and language-model processing both run on Sydney servers, with no audio retained | Read |
| AgriWebb | AgTech & Agriculture AI | 21/25 | 5/5 | Privacy policy states the servers storing personal information are located in Australia | Read |
| Microsoft Copilot Studio | AI Agent Builders | 20/25 | 4/5 | Agent data can be stored in Australia East (Sydney) or Australia Southeast (Victoria) | Read |
| Zoho Desk Zia AI | Customer Service & AI Chatbots | 20/25 | 5/5 | Sydney and Melbourne data centres; residency is available across plans rather than sold as an upsell | Read |
| Pipedrive | Business, CRM & Sales AI | 20/25 | 4/5 | Asia-Pacific accounts are primarily hosted in the Sydney AWS region; US sub-processors are used, so confirm your account in writing | Read |
| Education Perfect | Education & Learning AI | 20/25 | 4/5 | Privacy policy states personal identifying data is stored in AWS Australian data centres | Read |
| Stile Education | Education & Learning AI | 20/25 | 4/5 | Student data stored on AWS infrastructure in Australia; Privacy Act compliance confirmed | Read |
| Power BI Copilot | Data Analysis & BI | 19/25 | 4/5 | Storage in Sydney and Melbourne, but Copilot prompts are processed via Azure OpenAI in US data centres | Read |
| HubSpot Breeze AI | Business, CRM & Sales AI | 19/25 | 4/5 | Sydney data centre opened February 2024; existing paid customers can migrate to it free. No IRAP assessment published | Read |
| Salesforce Einstein | Business, CRM & Sales AI | 18/25 | 5/5 | Runs in AWS Sydney with Hyperforce in-country storage; IRAP assessment at PROTECTED covering the Einstein Platform | Read |
| Atlassian Rovo | Productivity & Workflow | 18/25 | 4/5 | Australian residency generally available since July 2025; Rovo follows the residency pin of the Jira or Confluence instance and is not itself named in the IRAP letter | Read |
| Harvey AI | Legal, Compliance & HR | 18/25 | 4/5 | Security page states customers can keep everything in-region, including Australia, on Microsoft Azure | Read |
| GovReports | Finance & Accounting AI | 17/25 | 5/5 | Hosted with ORION VM Australia, encrypted in transit and on backup. No IRAP assessment | Read |
The Australian tools that do not state it
This is the section that surprises people, and it is the reason we do not treat "Australian-built" as a residency answer. Each of these is a strong Australian product. None of them states where your data physically lives, or states plainly that it goes offshore.
| Tool | Score | AU Fit | What the review found | Review |
|---|---|---|---|---|
| Archistar | 22/25 | 5/5 | Sydney-built and Privacy Act compliant. Its privacy policy states that uploaded content at rest stays on servers in Australia unless you share it with someone elsewhere — corrected 21 Sep 2026; this row previously said residency could not be confirmed | Read |
| Realtair | 22/25 | 5/5 | Privacy page returned a 404 when checked; no explicit residency statement from REA Group | Read |
| DataFarming | 22/25 | 5/5 | Publishes no statement on hosting location across its public pages | Read |
| SiteMinder | 22/25 | 5/5 | ASX-listed and Australian, but operates globally; confirm specifics if you have strict requirements | Read |
| Xero | 21/25 | 5/5 | Privacy notice states data may be processed in Australia, New Zealand and the United States. No Australian-only hosting region is offered | Read |
| Atomi | 21/25 | 4/5 | Privacy policy confirms processing on servers in many countries, outside the country you reside in | Read |
| Deputy | 21/25 | 4/5 | ISO 27001 and SOC 2 certified on AWS, but no public Australian-region residency commitment | Read |
| MYOB | 20/25 | 5/5 | Australian entity and Privacy Act compliant, but no explicit statement of where AU customer data is physically stored | Read |
| Thriday (now Tyro Accounting) | 20/25 | 4/5 | ISO 27001 certified, but public pages do not say where data is hosted, and note providers may be outside Australia | Read |
| Tanda | 20/25 | 5/5 | No specific Australian residency commitment in publicly accessible documentation | Read |
| Rex Software | 19/25 | 5/5 | Brisbane-built; the privacy-policy URL returned a 404 on checking and the security pages do not state a hosting location | Read |
| Karbon | 19/25 | 4/5 | States in-region storage, but the only region it names is the United Kingdom. Australia is not named | Read |
| Isaacus | 17/25 | 4/5 | Melbourne-headquartered, but the default cloud runs on US Azure and AWS. Onshore processing is the self-hosted path | Read |
| Haast | 14/25 | 3/5 | Australian data residency, onshore storage and Privacy Act treatment could not be confirmed | Read |
What to ask a vendor before you sign
Four questions, in this order. Get the answers in writing, on the contract or in an email you keep.
- Where is our data stored at rest, naming the region? "APAC" is not an answer. "ap-southeast-2" is.
- Where are prompts processed? Ask specifically about inference, not storage. This is where most residency claims stop being true.
- Does this apply to our plan? Residency is frequently Enterprise-only or assigned at contracting.
- Which sub-processors touch this data, and where are they? Email delivery, transcription and analytics are the usual leaks.
Frequently asked questions
What does Australian data residency actually mean?
Data residency is a statement about geography. It means the vendor stores your data in a data centre physically located in Australia. That usually means a Sydney or Melbourne region run by AWS, Microsoft Azure or Google Cloud. It does not tell you which country's laws can reach that data, and it usually does not tell you where your prompts are processed.
Is data residency the same as data sovereignty?
No. Residency is about where data sits. Sovereignty is about whose law governs it and who can compel access. A US-headquartered vendor can store your data in Sydney and still be subject to US legal process. An Australian region alone does not give you sovereignty. If you need both, ask for both separately and get the answer in writing.
Does an Australian region mean my prompts are processed in Australia?
Usually not. Most vendors that advertise Australian data residency are describing storage at rest, and many of them process prompts on servers overseas. Microsoft documents this openly for Power BI. Data can sit in Australian data centres while Copilot prompts run on Azure OpenAI in United States data centres. Ask about inference specifically, because a storage answer will not cover it.
Does an IRAP assessment or ISO 27001 prove Australian data residency?
No. Certifications describe how a vendor runs its security programme. They say nothing about where your data is stored. A vendor can hold ISO 27001, SOC 2 and an IRAP assessment while hosting your data entirely offshore. Several tools we have reviewed do exactly that. Treat a certification badge as a security signal and ask the residency question separately.
How many AI tools have you checked for Australian data residency?
Our residency sweep (20 September 2026) read 165 reviews looking for a residency statement. The 30 tools named on this page were each re-read against their own review on 20 September 2026. A tool missing from this page usually means we found no clear public statement, not that its data goes offshore.
Last reviewed: 20 September 2026. Every claim here is the vendor's own statement, as recorded in the linked review on its verification date. It is not an audit by us. How we source and correct: Methodology and Editorial and Corrections Policy. For the long read, see our guide to AI data residency in Australia. New here? Start at Start Here.