Where data sits does not settle who can compel it. AustraliaOS establishes that exposure for Australian institutions, and for the providers they rely on: primary source verified, every contestable judgment named, the reasoning open to review.
Australian institutions are moving their most critical data onto infrastructure that is owned, operated, or legally controlled offshore. Where the data physically sits is not the question that matters most. The question is whose law can compel its disclosure.
A provider within a foreign government's legal reach can be compelled to hand over data, regardless of where it is stored. The United States CLOUD Act is the clearest case. It requires a provider of electronic communication or remote computing services to preserve or disclose communications and customer records within its possession, custody, or control when US legal process requires it, regardless of whether they are located within or outside the United States. CPS 230, APRA's operational risk standard, defines offshoring by where a service is performed, and its practice guide, CPG 230, frames the question as engaging a provider in another jurisdiction; neither directs an institution to assess whether a foreign government can compel its provider to disclose. It falls between procurement, privacy, and security. So it is rarely assessed at all.
AustraliaOS sells no infrastructure, resells no provider, and holds no incentive to reach a particular conclusion.
Conclusions rest on statute, binding agreements, and provider terms. Each is cited and independently checkable. Not summaries. Not vendor assurances.
Every contestable judgment is named, not buried. The reasoning is published so a board, an accountable officer, or an opposing expert can interrogate it.
On 19 December 2025 the Department of Defence announced a multi-year Deed of Standing Offer with Google Australia Pty Ltd for “enhanced, secure and air-gapped hyperscale cloud capability for Defence’s ICT Environment”. The record names the entity. It does not publish how the capability is operated: the release names no operator and states no value, location or security classification, and Defence says all specific details remain strictly confidential. Google’s description of its air-gapped product says its Infrastructure Operator could be Google, a contracted third party or the customer. Whether 18 U.S.C. § 2713 reaches data held in the capability is a legal question the assessment states and does not answer.
A practice that assesses foreign legal reach should be held to the standard it applies to others. So here is the honest position of every component behind AustraliaOS today. AustraliaOS is currently exposed to the reach it assesses. That is disclosed deliberately. No party should claim a jurisdictional position it has not earned, including this one.
| Component | Today | Reach |
|---|---|---|
| Research and drafting | Claude, provided by Anthropic, PBC. Used by the practice to research and draft. No application is deployed and no API key is held. | Anthropic, PBC, a Delaware public benefit corporation. |
| Website hosting | Vercel Inc. Static files only, no server functions. Requests from Australia are served from Vercel's Sydney edge. | Vercel Inc., a Delaware corporation. |
| DNS hosting | Vercel Inc. (ns1 and ns2.vercel-dns.com). | Vercel Inc., a Delaware corporation. |
| Google (mail for the domain is delivered to smtp.google.com). | Google. Parent: Alphabet Inc., a Delaware corporation. | |
| Domain registrar | GoDaddy.com, LLC, for australiaos.com.au. | GoDaddy.com, LLC, a Delaware company. Ultimate parent: GoDaddy Inc., a Delaware corporation. |
| Source code hosting | GitHub, Inc. Holds the site and the practice's records, including the evidence manifests. | GitHub, Inc., a Delaware corporation. Parent: Microsoft Corporation, a Washington corporation. |
| Persistent storage | None runs. The database served the practice's application, and both were retired; the database has been deleted. | — |
| Audit log | None runs. It was written by the same application, which has not run since June 2026. Audit statements on verification pages speak as at their dates. | — |
Company register evidence is acquired from ASIC Connect and ABN Lookup directly, with no commercial intermediary. Both are Australian statutory services, and extracts are purchased under s1274A of the Corporations Act. This is a standing dependency: there is no alternative source of Australian company register data, and none is sought.
The record of the evidence, the manifests and per source hashes, is held in the repository disclosed in the table above and is subject to the same 18 USC 2713 reach. The evidence itself is held outside version control on practice controlled storage, under a policy that exists because purchased extracts contain third party personal information, with an encrypted copy held separately. Hashing defeats undetected alteration but does not address availability of either layer. Link verification falls back to Internet Archive snapshots under a strict fail rule, placing a US incorporated nonprofit inside the pass condition of the verification engine.
Every provider in the table is incorporated in the United States or is controlled by a company that is. The practice treats each as within reach of US legal process; whether 18 USC 2713 applies to a particular service is a judgment, and it is named here rather than assumed away. The practice runs no application, database or server code, so what these providers hold is the site, the practice's records and its correspondence. Every dependency is named here, not hidden. Every decision made on the strength of this practice should be made with full knowledge of what runs where.
Every assessment is built in three layers, each carrying a different kind of attestation. The boundary between verified fact and judgment is explicit.
Facts tested against primary sources. Each is cited and checkable, and marked supported, partial, not supported, or unverified.
Reasoning over the verified facts. Each block names the step at which a reasonable reader could disagree.
Proposed actions, each citing the analysis that motivates it. Labelled as proposed, never presented as verified fact.