Australian legal context
Vericode is an Australian business. Its handling of personal information is governed by the Privacy Act 1988 (Cth) and the Australian Privacy Principles where they apply.
Data residency
Customer data, hosted in Australia.
Customer and verification data (recipient details, messages and verification records) is hosted in Australia. Staff sign-in is handled by our identity provider, WorkOS, in the United States; see the exceptions below.
Core hosting
Google Cloud
Production compute and PostgreSQL
Region
Sydney
australia-southeast1, New South Wales
Primary stores
Australian
Customer and verification records
A region you can name
Vericode's production application compute and PostgreSQL database run in Google Cloud's australia-southeast1 (Sydney) region in New South Wales.
Our primary customer and verification stores are not replicated to an overseas region. We do not publish recovery-point or recovery-time numbers that have not been formally committed.
Region checked against the live Google Cloud production configuration on 4 October 2026.
Primary stores stay here
Customer and verification records remain in Australia. This limits exposure of those primary stores to direct overseas data-access regimes, including the US CLOUD Act.
Useful diligence evidence
A named provider and region gives regulated firms a concrete answer for their own licensee, client and insurer reviews.
Exceptions, honestly
Some services cross borders.
Staff identity
WorkOS handles staff names, work email addresses and sign-in events in the United States. It does not host Vericode's primary customer or verification record stores.
Messages and carriers
Verification messages pass through MobileMessage, an Australian SMS provider, and the recipient's telecommunications carrier. Vericode uses the ACMA-registered sender ID VERICODE; carrier delivery is not the same as offshore storage of the primary verification record.
Business services
Stripe processes billing information and Loops delivers transactional or lifecycle email. These providers may process limited business-contact information outside Australia.
Vericode's external status monitor does not receive customer or verification data. The full subprocessor list names every provider and where it operates.
For regulated firms
Make the residency answer easy to evidence.
Brokers and advisers
Answer licensee, aggregator and insurer questionnaires with a named hosting region.
Law and accounting firms
Explain where verification evidence is held when handling sensitive instructions.
Compliance teams
Map primary data stores and disclosed exceptions to Privacy Act and APP obligations.
Need this for a questionnaire?
Read the subprocessor list and the legal documents already published, or ask for supporting security information.