Data residency.

Default posture

Fydis runs in a single region: AWS ap-southeast-2, Sydney. Customer data includes uploaded source documents, generated evidence chains, sign-off logs, audit packs, and all associated metadata. All of this is stored, processed, and backed up within Australia. The application, database, and object storage are co-located in the same region. There is no passive replication to a secondary region; backups are within-region snapshots.

The marketing and documentation site runs on Vercel, outside AWS and outside Australia, but it holds no customer data and has no access to the application.

LLM provider routing

LLM inference is the only workload that may leave Australia, and only when a customer explicitly selects a US-based provider. The default routes stay in AU.

Changing the LLM provider from an AU-resident default to a US-based provider requires an Admin to update the organisation’s LLM policy. The policy change is logged with actor identity and timestamp. Customers on Enterprise can restrict the selectable providers to AU-only via a contract clause.

What leaves Australia

Under default policy, only operational metadata leaves Australia:

• Sentry (EU region). Application error reports containing stack traces and request metadata. Customer document content, evidence-chain payloads, and sign-off data are scrubbed before transmission.
• Postmark (US). Transactional email delivery for platform notifications such as sign-off alerts and audit pack ready events. The email body contains notification text only, not compliance data.

No customer documents, no evidence-chain content, no audit pack data, and no personal data beyond notification email addresses leave Australia under default policy.

Sovereign verification

The sub-processor list and LLM routing configuration are reviewed quarterly. Each review produces a traffic-flow attestation documenting which services received which categories of data during the period. Audit pack exports include a data-residency stamp on every page, identifying the region where the data was processed. The attestation pack is available to Enterprise customers on request.