AI providers that keep data in Australia

AWS Bedrock, Deepgram, Supabase and Fly.io run inside Australia. AWS Bedrock runs AI inference in ap-southeast-2 (Sydney) and is our default model service. Deepgram has had an Australian address generally available since 17 June 2026, covering speech-to-text, text-to-speech and its voice agent, hosted in Sydney. Supabase Postgres holds transcripts, agent configuration, embeddings and audit logs in AWS ap-southeast-2, and Fly.io runs our call servers in Sydney. OpenAI, which builds every knowledge base's search index, processes in the United States, and Google processes outside Australia when an operator chooses a Gemini model. Cartesia, Telnyx and Stripe are in the United States.

Deepgram is the communications vendor in our stack with an Australian address, generally available since 17 June 2026 for speech-to-text, text-to-speech and its voice agent, hosted in Sydney. Telnyx, which carries our phone lines and SMS, processes in the United States. Cartesia, our default speech recognition engine, names Australia among its regional deployments but publishes no address and sells it on enterprise contract only, so we do not claim it. Retention controls on our stack are a per-workspace retention window (30 days on Starter, 90 on Growth, your choice on Scale), zero data retention on Scale, and masking of card and ID numbers in every transcript line before it is saved.

Yes. Supabase Auth, AWS Cognito and Microsoft Entra each offer an Australian region. Our own platform uses Supabase Auth magic link and one-time code, hosted in AWS ap-southeast-2 (Sydney), with end-user TOTP enrolment available in account settings. We state only that these vendors offer an Australian region. Certifications and contractual terms vary by vendor and by the plan you buy, so confirm those with the vendor rather than taking them from this page.

Most of it can. Our default model runs on AWS Bedrock in ap-southeast-2 (Sydney), and transcripts, agent configuration, embeddings and audit logs rest in Supabase Postgres on AWS ap-southeast-2, encrypted with AES-256. Speech recognition runs overseas on Cartesia by default and can move to Deepgram in Sydney. Voice synthesis runs overseas by default, knowledge base search runs on OpenAI in the United States, and phone lines run through Telnyx, a United States carrier. Choosing OpenAI or Google as the model moves inference offshore.

Judge a platform leg by leg, on where each one runs and whether warm transfer is built in, rather than on a single residency claim. Our voice agents answer inbound calls and warm transfer to a human over Telnyx, so the call leg runs on United States carrier infrastructure. Speech recognition can stay in Sydney on Deepgram and the model in Sydney on AWS Bedrock, while the carrier path and voice synthesis stay overseas. Ask any vendor to split their answer the same way, and to name the legs they cannot move.

Telnyx carries inbound and outbound phone lines and SMS from the United States, so caller ID, call audio and call metadata pass through US infrastructure in transit. Speech recognition runs on Cartesia in the United States unless the agent uses Deepgram in Sydney. The default voice, ElevenLabs, runs in the United States. When the agent searches a knowledge base, the question goes to OpenAI in the United States to be matched. If AWS Bedrock fails mid-call, the model call falls back to Anthropic in the United States. AI inference otherwise stays in Sydney on AWS Bedrock, and transcripts, agent configuration, embeddings and audit logs rest in Supabase Postgres on AWS ap-southeast-2.

Transcripts, agent configuration, call analytics, embeddings and audit logs live in Supabase Postgres on AWS ap-southeast-2 (Sydney). AI inference runs in Sydney on AWS Bedrock by default, and the call servers run on Fly.io in Sydney. Error reports go to Sentry and product analytics to PostHog, both in the European Union. Call telemetry without transcript content goes to Langfuse in the European Union and Axiom in the United States. Vercel's edge network serves the website's static files and stores no customer data.

We do not train models on customer data. AWS Bedrock, our default model service, does not store prompts or use them for training. Deepgram and Cartesia contractually do not train on input sent through their APIs.

Transcripts sit under the same row-level security isolation as the rest of the database, so only members of your organisation can read them. Before a transcript line is saved, a redactor masks credit card numbers (Luhn-validated), Australian Tax File Numbers, Medicare numbers and US Social Security numbers.

We are not SOC 2 certified yet. SOC 2 Trust Services Criteria controls are implemented and mapped against our environment, covering access review, change management, incident response, vendor review, audit logging and encryption. The independent audit has not been done. ISO 27001 follows the same cadence, and HIPAA and IRAP are out of scope today.

We have mapped all eight controls. Six are fully met within our cloud-native scope: Application Control through managed platforms, Patch Applications through Dependabot, Restrict Administrative Privileges through row-level security and service-role discipline, Patch Operating Systems through Vercel, Fly.io and Supabase, Multi-factor Authentication on infrastructure plus end-user TOTP enrolment, and User Application Hardening through response headers. One is partly met: backup restoration drills are documented, but the quarterly cadence is still starting. One does not apply (Microsoft Office macros). We do not claim Maturity Level 1 as a whole until the restoration drills are on cadence.

Yes. Our standard DPA covers GDPR Article 28 and APP 8 obligations and suits most small and mid-market customers. Email legal@verticalai.com.au with your entity name. Custom DPAs are available on request for regulated entities in healthcare, finance and superannuation.