#Data Residency Statement: Australia

DIS-AU-008 | Version 1.0.0 | Last Modified On 01 August 2026

The Australian fork of DIS-GL-008. Read this document for an Australian deployment. DIS-GL-008 remains the global statement and the source of truth for every other market; it is not repeated here.

---

#Applicability

---

#Purpose

To state where an Australian hospital's data is stored, where it is processed, where its logs live, and which countries a human being can reach it from, separating what Australian law requires from what Australian buyers ask for, because they are not the same thing and conflating them produces a claim Pensieve cannot defend under questioning.

---

#1. What the law requires, and what buyers ask for

The honest summary. Australian law does not require Pensieve to host in Australia unless My Health Record is in scope. Australian buyers behave as though it does. Arguing the legal point is technically correct and commercially expensive. Pensieve concedes the region and spends the credibility elsewhere.

---

#2. The four components, answered for Australia

Residency has four components and most vendors answer only the first.

Access is the component that defeats the other three when it is ignored, and it is the one Pensieve states first in an Australian conversation. Hosting in Sydney does not mean the data stays in Australia if an engineer in India can read it. For information other than My Health Record content that is an APP 8 accountability question, which contract and controls address. For My Health Record content it is s.77, which they do not. See Section 6.

Google Cloud operates two Australian regions and Cloud Run is available in both, so the primary region and the disaster recovery region are both Australian without a change to the architecture.

Google Cloud holds Certified Strategic status under the Hosting Certification Framework. Pensieve may state that its Australian hosting provider holds that certification. Pensieve does not hold it and does not imply that it does: the certification attaches to the hosting provider. The Hosting Certification Framework is in any case a Commonwealth-government instrument with no application to a private hospital; REG-AU-002 Section 5 says so plainly rather than staying silent.

---

#3. Per deployment model

Current status of the Australian DM-2 estate: Pensieve au dm2 estate status. Where that token resolves to anything other than a live Australian estate, DM-2 is quoted in Australia only to a buyer that has confirmed in writing that it has no residency requirement. This is a sales rule, not a preference.

Deployment-model correctness. A sentence such as "Pensieve hosts Australian customer data in Australia" is false for DM-2 unless an Australian estate exists, and is not Pensieve's to assert for DM-3 or DM-4, where the hospital chooses. Every Australian residency claim made by Pensieve in a tender, a questionnaire or a proposal must carry the table above or a variant block.

---

#4. What is not regionalised: enumerated rather than glossed

Selecting an Australian region does not by itself put every byte in Australia. Some cloud services are multi-regional or global by default: certain logging sinks, some error-reporting and diagnostic pipelines, some managed AI endpoints, and parts of provider support tooling. A residency claim that ignores this is a claim that fails under questioning.

Pensieve's position:

1. The service-by-service review is an open engineering item. REG-AU-002 Section 6 carries it with a named owner. Until it is complete, Pensieve states the position for the components it has verified and marks the rest as unverified rather than asserting coverage. [UNVERIFIED: the complete list of Pensieve-stack services that are not regionalised to Australia had not been produced as at the Last Modified On date of this document. Do not represent a service-level guarantee that this document does not make.]
2. What Pensieve does commit to today, and these are testable: patient records, clinical data, prescriptions, results, images, billing and financial records are stored and processed in Deal data region; backups do not leave it; system and audit logs are written to a regional bucket in it; encryption keys are held in the key management service of that region. DIS-GL-011.
3. What crosses a border, exhaustively. Three categories, and none of them is patient data: Trust Center business contact data; support correspondence, under the minimisation rules in DIS-AU-033 Section 5; and aggregate operational telemetry containing no personal information. DIS-GL-008 Section 3 defines each.
4. Managed AI features. Where the Platform uses a managed model endpoint, the region of that endpoint is disclosed per feature in DIS-GL-027, and a feature whose endpoint is not Australian is not enabled by default for an Australian tenant.

---

#5. The Trust Center is a separate question with a separate answer

The Trust Center (the application serving this document, the contract set and the access grants) runs on its own stack, listed in DIS-GL-009 Section 3. It is not hosted in Australia, it is not connected to any Platform instance, and it holds no patient data. What it holds about an Australian hospital is: the names and work e-mail addresses of the hospital's authorised users, which documents they opened and when, and the executed documents themselves.

This is stated because a residency answer that silently covers only the product is the kind of omission that destroys credibility when a reviewer finds it. A hospital that requires the contract set itself to be held in Australia should raise it at qualification; the answer today is that it is not.

---

#6. My Health Record: the constraint that is not about hosting

Section 77 of the My Health Records Act 2012 prohibits a registered contracted service provider that holds or has access to My Health Record system records from holding or taking those records outside Australia, or from processing or handling information relating to those records outside Australia. The penalty includes imprisonment.

Australian hosting satisfies the first limb and does not satisfy the second. The second limb is a constraint on people. Pensieve's engineering and support function is in India.

Consequently: Pensieve does not offer My Health Record connectivity, and will not represent to an Australian hospital, a tender or the Australian Digital Health Agency that it does. The full statement of the position, its consequences per deployment model, and the condition on which it could change are in DIS-AU-033 Section 4 and DPA-AU-001 Section 5.2. The contractual restriction is MSA-AU-001 AU-11.

Related, and separately consequential. A hospital that authors its own pathology or diagnostic imaging written reports has a statutory obligation to upload those reports to My Health Record within the prescribed period. Pensieve cannot discharge it. That hospital must retain a system that can, and Pensieve raises it at qualification.

---

#7. Where Pensieve cannot meet an Australian requirement

Stated rather than omitted, because a disclosure without this section is worth less than one with it.

---

#8. Changing the region after go-live

A region change is a migration, not a configuration switch. It is executed as a Change Order (ADD-GL-015) against the migration runbook, requires a maintenance window, and carries a cost recorded in the Change Order. Pensieve will not move an Australian tenant out of Australia, and a request to do so is refused rather than priced.

---

#9. Limitations

1. Residency is not security. Data held in Australia and poorly controlled is worse than data held elsewhere and controlled well. The controls are in ADD-GL-001; this document is about location.
2. Pensieve does not control DM-3 or DM-4 residency, and says so rather than claiming credit for the hospital's choice.
3. The service-by-service map is incomplete (Section 4).
4. This document states a position, not a certification. No Australian body certifies data residency for a private-sector supplier, and Pensieve holds no such certificate.
5. Nothing here is legal advice to the hospital about its own obligations under State health records law or the Privacy Act.

---

#Related documents

---

#Change history