AWS, Microsoft and Deepgram run AI inside Australia.

AWS Bedrock, Microsoft Azure OpenAI, Deepgram, Supabase and Fly.io all run inside Australia. AWS Bedrock runs AI inference in ap-southeast-2 (Sydney) and Microsoft Azure OpenAI runs it in Australia East. Deepgram has had an Australian address generally available since 17 June 2026, covering speech-to-text, text-to-speech and its voice agent, hosted in Sydney. Supabase Postgres holds transcripts, agent configuration, embeddings and audit logs in AWS ap-southeast-2, and Fly.io runs voice compute in Sydney. OpenAI and Google store data in Australia but process it offshore, so we treat both as offshore. Cartesia, Telnyx and Stripe are United States.

Deepgram is the communications vendor in our stack with an Australian address, generally available since 17 June 2026 for speech-to-text, text-to-speech and its voice agent, hosted in Sydney. Telnyx, which carries our phone lines and SMS, processes in the United States. Cartesia names Australia among its regional deployments but publishes no address and sells it on enterprise contract only, so we do not claim it. Retention controls on our stack are a per-workspace window of 30, 90, 365 or 730 days, hard deletion within 7 days of a request, and PII masking of every transcript line before it reaches the database.

Yes. Supabase Auth, AWS Cognito and Microsoft Entra each offer an Australian region. Our own platform uses Supabase Auth magic link and one-time code, hosted in AWS ap-southeast-2 (Sydney), with end-user TOTP enrolment available in account settings. AWS Cognito is available in ap-southeast-2 and Microsoft Entra offers an Australian region. We state only that these vendors offer an Australian region. Certifications and contractual terms vary by vendor and by the plan you buy, so confirm those with the vendor rather than taking them from this page.

Yes, if the model, the speech layer and the database all sit in Australia. AI inference runs on AWS Bedrock in ap-southeast-2 (Sydney) by default, with Microsoft Azure OpenAI in Australia East as the second default. Speech-to-text and text-to-speech can run on Deepgram in Sydney, generally available since 17 June 2026. Transcripts, agent configuration, embeddings and audit logs rest in Supabase Postgres on AWS ap-southeast-2, encrypted with AES-256. Selecting OpenAI or Google as the model moves inference offshore. Phone lines run through Telnyx in the United States.

Judge a platform leg by leg, on where each one runs and whether warm transfer is built in, rather than on a single residency claim. Our voice agents answer inbound calls and warm transfer to a human over Telnyx, so the call leg is United States-routed carrier infrastructure. Audio processing can stay in Sydney via Deepgram and the model in Sydney via AWS Bedrock, which means the conversation runs onshore while the carrier path does not. Ask any vendor to split their answer the same way, and to name the legs they cannot move.

The carrier leg leaves the country. Telnyx carries inbound and outbound phone lines and SMS from the United States, so caller ID, call audio and call metadata pass through US infrastructure in transit. Text-to-speech runs on Cartesia in the United States, and Deepgram's Sydney address also covers text-to-speech. Speech-to-text can stay in Sydney on Deepgram, and AI inference stays in Sydney on AWS Bedrock or in Australia East on Microsoft Azure OpenAI. Everything at rest, transcripts, agent configuration, embeddings and audit logs, stays in Supabase Postgres on AWS ap-southeast-2. None of the United States vendors train on customer data.

Transcripts, agent configuration, analytics, embeddings, and audit logs all live in Supabase Postgres on AWS ap-southeast-2 (Sydney). AI inference runs in Sydney on AWS Bedrock, and voice compute on Fly.io Sydney. Static assets are served via Vercel's edge network; no customer data is stored at the edge.

We do not train models on customer data. AI inference runs on AWS Bedrock in Sydney, which does not store prompts or use them for training. Our speech vendors (Deepgram, Cartesia) contractually do not train on input sent through their APIs.

Transcripts are stored under the same Row-Level Security isolation as the rest of the database; only members of your organisation can read them. Before persistence, every transcript line passes through a redactor that masks credit card numbers (Luhn-validated), Australian Tax File Numbers, Medicare numbers, and US Social Security numbers.

Not yet. SOC 2 Trust Services Criteria controls are implemented and mapped against our environment (access review, change management, incident response, vendor review, audit logging, encryption). The independent audit has not been completed. We engage Vanta or Drata once the first enterprise contract triggers it. ISO 27001 follows the same cadence; HIPAA and IRAP are out of scope today.

Mapped. Six of the eight controls are fully met within our cloud-native scope: Application Control via managed platforms, Patch Applications via Dependabot, Restrict Administrative Privileges via RLS and service-role discipline, Patch Operating Systems delegated to Vercel/Fly/Supabase, Multi-factor Authentication on infra surfaces plus end-user TOTP enrolment in account settings, and User Application Hardening via response headers. One control is partially met: backup restoration drills are documented, but the quarterly cadence is still ramping up. One does not apply (Microsoft Office Macros). We do not publicly claim ML1 as a whole until the restoration drills are on cadence.

Yes. Our standard DPA covers GDPR Article 28 and APP 8 obligations and handles most SMB and mid-market deals. Email legal@verticalai.com.au with your entity name. Custom DPAs are available for regulated entities (healthcare, finance, super) on request.