Choosing an AI agency in Canberra

The first question to ask an AI agency

Ask where your prompts are processed, provider by provider, and ask for the answer in writing. A supplier who runs a database in Sydney and sends every prompt to a model in Oregon has Australian hosting and offshore processing. Those are two facts and a single sentence about sovereignty hides the gap between them.

The Canberra buyers we speak to are government-adjacent suppliers, associations and professional-services firms working under federal procurement rules. The answer has to survive a security review months after the sales call, so it needs provider names, regions and dates.

Written answers also settle a question that meetings cannot. A supplier reading its own residency facts off a document has checked them against the vendors at some point. A supplier answering from memory in a room has not, and the two sound identical while you are sitting there.

• Which region each provider processes the prompt in, named exactly.
• Where the data sits at rest, and under whose encryption.
• What the retention window is, and whether you can purge inside it on request.
• Which assessments the supplier holds today, separated from the ones on a roadmap.
• What the supplier will write into a data processing agreement before you sign.

Why the Canberra buyer asks different questions

Procurement is the reason. A Canberra organisation buying an AI system is usually answering to a security team and a contract before it answers to a budget, so the residency evidence and the data processing agreement have to exist before the conversation starts. Our data-residency evidence, the zero-retention configuration and a custom agreement are available under NDA.

Canberra shares Sydney's timezone, runs on an 02 prefix, and sits 10 milliseconds from the Sydney data plane, so a system built for a Canberra organisation runs in ap-southeast-2 with no latency cost for staying onshore. Perth pays 58 milliseconds for the same decision.

AEST and AEDT both apply in the ACT and in Sydney, so a schedule, a report window and a log timestamp resolve against one zone.

Where each provider processes your prompts

The table below is the stack we build on, read off each vendor's own documentation on 12 August 2026. A cell we could not source from that documentation says "not published", and we never fill one with a guess.

AWS Bedrock is the default model path, processes in ap-southeast-2, and retains neither prompts nor responses. If Bedrock fails mid-call, the model call falls back to Anthropic's own service in the United States.

Providers that store in Australia and process offshore

OpenAI direct and Google Gemini each store data at rest in Australia and process the prompt outside it, and each states that it does not train on the data. Neither publishes a retention window.

A supplier can describe either provider as offering Australian data residency and be accurate, which is what makes the phrase worth little on its own. The at-rest region and the processing region are separate answers and a security review will want both. On this stack both providers are optional and run only when an operator selects one, so the question to ask a supplier is which provider the default path uses.

Supabase carries the data that persists: transcripts, agent configuration, embeddings and audit logs, in ap-southeast-2 and encrypted with AES-256 at rest. Retention is set per workspace, 30 days on Starter, 90 on Growth and your choice on Scale, with deletion on request. A retention window you can name is the part of a residency answer a procurement team can test.

IRAP assessment

The stack has not been through an IRAP assessment. It is protected-adjacent: Australian-hosted, tenant-isolated and configurable to retain nothing. For classifications above that we scope a bespoke deployment rather than claim the shared one covers it.

SOC 2 Type II sits on a documented roadmap and is not a certificate we hold. The current evidence package goes to security teams on request.

Ask every supplier on your shortlist the same question and ask for the assessment letter and its date. A supplier who answers yes without producing one has told you something useful about the rest of its answers.

Deployments for government and defence suppliers

Our hosted platform is for unclassified work. A Canberra organisation that needs more control can run the call plane in an AWS account dedicated to it, or in its own VPC in Sydney. The database, recordings and stored secrets are then encrypted under a KMS key that can live in your own AWS account, and revoking it leaves the data unreadable.

Your staff sign in through your identity provider over SAML 2.0 or OIDC. If Sydney does not answer within 5 seconds, a handler in Melbourne answers and forwards the caller to your fallback number. Our enterprise deployment page, linked below, sets out each of the four deployments.

For defence industry suppliers we build voice interfaces tuned to follow an exact instruction in loud environments, set out on our defence page. Work above unclassified is built into an environment you hold rather than run on the shared platform.

What an AI build costs in Canberra

An AI build has two prices, the one-off build and the monthly cost of running it. Ask every Canberra AI agency for both as separate numbers, with the model tier the running cost assumes. The table lists our published prices, read off our own pages on 17 October 2026.

Custom AI and software is priced by the day, the build or the month, on a fixed quote. A voice agent is a one-off build fee, then a monthly plan and A$0.40 a minute past the allowance, billed only while an agent is on a call.

Code, prompts, configuration and documentation are yours at handover, on your own infrastructure and accounts. A quote above budget is cut in scope until it fits, then requoted fixed.

What an AI agency builds

Two shapes cover most of the work. The first removes a manual process that someone does the same way every week, and the measure of it is how long that process takes afterwards. The second changes how a team works, and the measure is what the team ships in the following month. Our two public projects are one of each.

Either shape has to reach into the systems you already run, because a system that cannot read your records only moves the typing somewhere else. We maintain managed connections to 17 systems across six categories: CRM in Salesforce, HubSpot, Pipedrive and Zoho, scheduling in Google Calendar and Calendly, messaging in Slack, Microsoft Teams, Gmail and Outlook, support in Zendesk and Intercom, records in Notion, Airtable, Google Sheets and monday.com, and payments in Stripe.

Ask a supplier which of your systems it writes to rather than only reads from. Reading is the easy half. A system that looks up a record and then hands a human a summary to retype has automated the lookup and left the work where it was, and the difference shows up in the time the process takes.

Ask what happens when a connection fails, too. A build that stops at the first timeout needs a person watching it, and that person is a running cost nobody quotes.

Delivery evidence

Ask for named clients, dates, and a number that moved. An unnamed case study is a claim, and a percentage with no client attached to it is a weaker claim.

Three of ours are public. OPMS, a West Perth software company, ran a one-day AI workshop against their own production repositories, and during it three agents reviewed three pull requests at once. At Effortless Superhuman, a Perth integrative health clinic, a Cliniko integration and a custom Claude Skill cut patient onboarding from 60 minutes to 15, with two human sign-offs on every patient.

The Mayfair Emerald, a pub in Emerald, Queensland, runs its courtesy bus line on a dispatch voice agent we built. Its median call is 54.5 seconds, read 15 September 2026, and the build took under four weeks from signed contract to live.

We also built a private AI platform inside a client's own Azure tenant, for data that has to stay in an environment the client already holds. That client is not named on this site. Ask every supplier what happened to each system after handover and who runs it now.

Projects suited to a different supplier

A tender that requires an IRAP assessment or a SOC 2 Type II report today needs a supplier that holds one, and we hold neither. We have no Canberra office, so a buyer who wants a supplier on site every week suits a firm based in the ACT.

Our published services cover AI agents, voice agents, software, workshops and support. They do not include ad management, SEO or email campaigns, and a marketing automation agency suits that work better.

The shortlist

Send every supplier the same questions and compare the written answers. Written answers separate suppliers faster than a capability deck, because a specific one is hard to fake and a vague one identifies itself.

• Ask for the provider-by-provider processing and at-rest regions, in writing, before the second meeting.
• Ask which assessments the supplier holds today and request the letter and its date.
• Ask for the retention window and whether hard deletion is available on request.
• Ask for two named clients with a date and a number against each.
• Ask for the running cost separated from the build fee, with the model tier named.
• Ask who operates the system after handover, and what happens if that person leaves.