Australian legal context
Vericode is an Australian business. Its handling of personal information is governed by the Privacy Act 1988 (Cth) and the Australian Privacy Principles where they apply.
Data residency
Customer data, hosted in Australia.
Customer and verification data — recipient details, messages and verification records — is hosted in Australia. Staff sign-in is handled by our identity provider, WorkOS, in the United States; see the exceptions below.
Core hosting
Microsoft Azure
Production compute and PostgreSQL
Azure region
Australia East
Sydney, New South Wales
Primary stores
Australian
Customer and verification records
A region you can name
Vericode's production application compute and PostgreSQL database run in Microsoft Azure's Australia East region in New South Wales.
Our primary customer and verification stores are not replicated to an overseas region. We do not publish recovery-point or recovery-time numbers that have not been formally committed.
Region checked against the live Azure production resource group and infrastructure configuration on 19 July 2026.
Primary stores stay here
Customer and verification records remain in Australia. This limits exposure of those primary stores to direct overseas data-access regimes, including the US CLOUD Act.
Useful diligence evidence
A named provider and region gives regulated firms a concrete answer for their own licensee, client and insurer reviews.
Exceptions, honestly
Some services cross borders.
Staff identity
WorkOS handles staff names, work email addresses and sign-in events in the United States. It does not host Vericode's primary customer or verification record stores.
Messages and carriers
Verification messages pass through MobileMessage or ClickSend and the recipient's telecommunications carrier. Vericode uses the ACMA-registered sender ID VERICODE; carrier delivery is not the same as offshore storage of the primary verification record.
Business services
Stripe processes billing information and Loops delivers transactional or lifecycle email. These providers may process limited business-contact information outside Australia.
Vericode's external status monitor does not receive customer or verification data. A full public subprocessors page is pending legal review; current details are available on request.
For regulated firms
Make the residency answer easy to evidence.
Brokers and advisers
Answer licensee, aggregator and insurer questionnaires with a named hosting region.
Law and accounting firms
Explain where verification evidence is held when handling sensitive instructions.
Compliance teams
Map primary data stores and disclosed exceptions to Privacy Act and APP obligations.
Need this for a questionnaire?
Ask for supporting security and subprocessor information, or review the legal documents already published.