When an Australian business connects an AI tool to its email, customer records or finance system, the data usually leaves the building. Often it leaves the country. Many business owners are comfortable with that in principle, as long as they know where the data goes and who can touch it. The problem is that many vendors make that hard to find out.
Data residency sounds like a technical detail. In practice it is a governance question: which country's laws apply to your business information, and what can you honestly tell customers when they ask where their records are processed.
What Australian law expects
If your business is covered by the Privacy Act, Australian Privacy Principle 8 deals with cross-border disclosure of personal information. Before you send personal information to an overseas recipient, you need to take reasonable steps to make sure they handle it in line with the APPs, and in many cases you stay accountable for what they do with it. The OAIC has also published specific guidance on using commercially available AI products, which points businesses at exactly these due-diligence questions.
You do not need to become a privacy lawyer. You do need straight answers from your vendors before you connect anything.
Residency is more than a pin on a map
A vendor saying "hosted in Australia" can mean several different things, and they are not interchangeable:
- Storage. Where your records, documents and conversation history are kept at rest.
- Inference. Where your prompts and data travel each time the AI generates an answer. Plenty of tools store data onshore but send every prompt to an offshore model API.
- Training. Whether your data is used to train or fine-tune models at all, and whether that happens in the same jurisdiction.
- Access. Which countries the vendor's support and engineering staff can see your data from.
Each of these is a separate question. A single checkbox answer like "yes, we're in the Sydney region" usually covers only the first one.
Questions worth asking any AI vendor
- Where is our data stored, and can we choose the region?
- When the AI answers a question, which countries does our data pass through?
- Is any of our data used to train models? If so, can we opt out, and does opting out change the product?
- Is our environment shared with other customers, or is it ours alone?
- Which AI providers and models run on our data, and can we change them?
- Who inside the vendor can access our data, from where, and is that access logged?
- If we leave, how is our data returned and deleted, and from which locations?
A vendor that handles business data well will have plain answers to all of these. Vague ones are an answer too.
How we approach it at Holiday
We built Holiday so these questions have simple answers. Your Holiday Environment is single-tenant: the structured view of your business is yours alone, not pooled with other customers. It is hosted in the AWS region you choose, so an Australian business can keep its environment in Australia. You select which AI providers and models run in it, and you can change them as your requirements change. Access permissions are enforced in application code, and AI activity is recorded so you can review exactly what happened.
That is what we think "on your terms" should mean for residency: you decide where your business lives, and you can verify the answer instead of trusting a marketing page.
Related: Before staff connect AI to customer records and Give AI a job, then define its authority.