Choosing an AI agency in Canberra

Ask where your prompts are processed, provider by provider, and ask for the answer in writing. A supplier who runs a database in Sydney and sends every prompt to a model in Oregon has Australian hosting and offshore processing. Those are two facts and a single sentence about sovereignty hides the gap between them.

The Canberra buyers we speak to are government-adjacent suppliers, associations and professional-services firms working under federal procurement rules. The answer has to survive a security review months after the sales call, so it needs provider names, regions and dates.

Written answers also settle a question that meetings cannot. A supplier reading its own residency facts off a document has checked them against the vendors at some point. A supplier answering from memory in a room has not, and the two sound identical while you are sitting there.

• Which region each provider processes the prompt in, named exactly.
• Where the data sits at rest, and under whose encryption.
• What the retention window is, and whether you can purge inside it on request.
• Which assessments the supplier holds today, separated from the ones on a roadmap.
• What the supplier will write into a data processing agreement before you sign.

Procurement is the reason. A Canberra organisation buying an AI system is usually answering to a security team and a contract before it answers to a budget, so the residency evidence and the data processing agreement have to exist before the conversation starts rather than be negotiated in afterwards. Our data-residency evidence, the zero-retention configuration and a custom agreement are available under NDA for that reason.

Geography helps here. Canberra shares Sydney's timezone, runs on an 02 prefix, and sits 10 milliseconds from the Sydney data plane, so a system built for a Canberra organisation runs in the ap-southeast-2 region with no latency cost for staying onshore. Perth pays 58 milliseconds for the same decision.

Canberra also has no daylight saving mismatch with the infrastructure. AEST and AEDT both apply in the ACT and in Sydney, so a schedule, a report window and a log timestamp resolve against one zone.

The table below is the stack we build on, read off each vendor's own documentation on 12 August 2026. Any cell we could not read off the vendor's documentation says "not published", and we never fill one with a guess of our own.

Two defaults matter more than the rest. AWS Bedrock is the default model path and processes in ap-southeast-2, and Bedrock retains neither prompts nor responses. Microsoft Azure OpenAI is the second default and processes in Australia East, and Microsoft does not publish its at-rest region, retention window or training position for that service, so the table says so.

OpenAI direct and Google Gemini both do. Each stores data at rest in Australia and processes the prompt outside it, and each states that it does not train on the data. Neither publishes a retention window.

A supplier can describe either provider as offering Australian data residency and be accurate, which is what makes the phrase worth little on its own. The at-rest region and the processing region are separate answers and a security review will want both. On this stack both providers are optional and run only when an operator selects one, so the question to ask a supplier is which provider the default path uses.

Supabase carries the data that persists: transcripts, agent configuration, embeddings and audit logs, in ap-southeast-2 and encrypted with AES-256 at rest. Retention is set per workspace at 30, 90, 365 or 730 days, with hard deletion available on request. A retention window you can name is the part of a residency answer a procurement team can test.

No, not today. The stack is protected-adjacent, meaning Australian-hosted, tenant-isolated and configurable to retain nothing, and it has not been through an IRAP assessment. For classifications above that we scope a bespoke deployment rather than claim the shared one covers it.

SOC 2 Type II sits on a documented roadmap here and is not a certificate we hold. The current evidence package goes to security teams on request.

Ask every supplier on your shortlist the same question and ask for the assessment letter and its date. A supplier who answers yes without producing one has told you something useful about the rest of its answers.

Scope decides the price of a build, so the quote comes from looking at your own systems. What is published is the running cost once a system is live, and that is the number most suppliers leave out of a proposal.

Voice agents start at A$0.25 a minute of connected call time on our rate card, with no plan fee and no minimum. The first A$20 is free. Australian phone numbers cost A$3.41 a month each. Billing runs only while an agent is on a call, so an idle line costs the number and nothing more.

Ask a supplier to separate the build fee from the running cost, and to name which model tier the running cost assumes. A rate quoted against a fast model and a system that ships on a reasoning model are different bills.

Two shapes cover most of the work. The first removes a manual process that someone does the same way every week, and the measure of it is how long that process takes afterwards. The second changes how a team works, and the measure is what the team ships in the following month. Our two public projects are one of each.

Either shape has to reach into the systems you already run, because a system that cannot read your records only moves the typing somewhere else. We maintain managed connections to 17 systems across six categories: CRM in Salesforce, HubSpot, Pipedrive and Zoho, scheduling in Google Calendar and Calendly, messaging in Slack, Microsoft Teams, Gmail and Outlook, support in Zendesk and Intercom, records in Notion, Airtable, Google Sheets and monday.com, and payments in Stripe.

Ask a supplier which of your systems it writes to rather than only reads from. Reading is the easy half. A system that looks up a record and then hands a human a summary to retype has automated the lookup and left the work where it was, and the difference shows up in the time the process takes, which a demo will not tell you.

Ask what happens when a connection fails, too. A build that stops at the first timeout needs a person watching it, and that person is a running cost nobody quotes.

Named clients, dates, and a number that moved. An unnamed case study is a claim, and a percentage with no client attached to it is a weaker claim.

Two of ours are public. OPMS, a West Perth software company, ran a one-day AI workshop against their own production repositories, and during it three agents reviewed three pull requests at once. At Effortless Superhuman, a Perth integrative health clinic, a Cliniko integration and a custom Claude Skill cut patient onboarding from 60 minutes to 15, with two human sign-offs on every patient.

Both are builds rather than pilots, which is the distinction worth probing. Ask what happened to each system after handover and who runs it now.

Send every supplier the same questions and compare the written answers, not the meetings. Written answers separate suppliers faster than a capability deck, because a specific one is hard to fake and a vague one identifies itself.

• Ask for the provider-by-provider processing and at-rest regions, in writing, before the second meeting.
• Ask which assessments the supplier holds today and request the letter and its date.
• Ask for the retention window and whether hard deletion is available on request.
• Ask for two named clients with a date and a number against each.
• Ask for the running cost separated from the build fee, with the model tier named.
• Ask who operates the system after handover, and what happens if that person leaves.