Where a provider is incorporated, not where its data sits, determines who can compel it. AustraliaOS establishes that exposure for Australian institutions: primary source verified, every contestable judgment named, the reasoning open to review.
Australian institutions are moving their most critical data onto infrastructure that is owned, operated, or legally controlled offshore. Where the data physically sits is not the question that matters most. The question is whose law can compel its disclosure.
A provider incorporated in a foreign jurisdiction can be compelled by that jurisdiction's government to hand over data, regardless of where it is stored. The United States CLOUD Act is the clearest case. It compels US incorporated providers to disclose on valid US legal process, wherever the data is held. Existing prudential standards require institutions to assess offshoring and country risk, but none isolates this question. It falls between procurement, privacy, and security. So it is rarely assessed at all.
Which legal entity holds each certification at the Hosting Certification Framework's Strategic tier, and which jurisdiction controls it. Of the 28 certified providers, 10 are under foreign control and 2 sit behind structures the companies register cannot see through. Every finding is resolved on primary ownership records, archived and hashed.
Brunel Al-Bijwaie, Director
AustraliaOS Pty Ltd · ABN 69 697 049 291
AustraliaOS sells no infrastructure, resells no provider, and holds no incentive to reach a particular conclusion. The assessment serves the institution accountable for the decision, and no one else.
Conclusions rest on statute, binding agreements, and provider terms. Each is cited and independently checkable. Not summaries. Not vendor assurances.
Every contestable judgment is named, not buried. The reasoning is published so a board, an accountable officer, or an opposing expert can interrogate it.
A practice that assesses foreign legal reach should be held to the standard it applies to others. So here is the honest position of every component behind AustraliaOS today, and where it is going. AustraliaOS is currently exposed to the reach it assesses. That is disclosed deliberately. No party should claim a jurisdictional position it has not earned, including this one.
| Component | Today | Phase 2 |
|---|---|---|
| Inference | Anthropic, PBC, a Delaware benefit corporation (CLOUD Act, 18 USC 2713). Location: US hosted inference API. | Australian incorporated inference provider, not yet selected |
| Persistent storage | Supabase, Inc., a Delaware corporation (CLOUD Act, 18 USC 2713). Location: storage in the United States. | Australian incorporated database provider |
| Compute (web layer) | Vercel Inc., a Delaware corporation (CLOUD Act, 18 USC 2713). Location: execution in US East (iad1). | Australian incorporated compute provider, execution within Australia |
| Source code hosting | GitHub, a Microsoft Corporation offering. Parent: Microsoft Corporation, Washington incorporated (CLOUD Act, 18 USC 2713). | Australian incorporated Git hosting provider, not yet selected |
| Audit log | Vercel Inc., a Delaware corporation (CLOUD Act, 18 USC 2713). Location: ephemeral, unsigned entries on Vercel /tmp. | Australian incorporated storage provider, with persistent entries signed under Australian key custody |
Company register evidence is acquired from ASIC Connect and ABN Lookup directly, with no commercial intermediary. Both are Australian statutory services, and extracts are purchased under s1274A of the Corporations Act. This is a standing dependency rather than a Phase 2 item: there is no alternative source of Australian company register data, and none is sought.
The record of the evidence, the manifests and per source hashes, is held in the repository disclosed in the table above and is subject to the same 18 USC 2713 reach. The evidence itself is held outside version control on practice controlled storage, under a policy that exists because purchased extracts contain third party personal information, with an encrypted copy held separately. Hashing defeats undetected alteration but does not address availability of either layer. Link verification falls back to Internet Archive snapshots under a strict fail rule, placing a US incorporated nonprofit inside the pass condition of the verification engine, and Phase 2 commits to Australian incorporated archive custody and a verification fallback not dependent on a single foreign archive.
Phase 2 migration onto Australian incorporated providers is the practice's primary technical commitment. Until it completes, every dependency is named here, not hidden. Every decision made on the strength of this practice should be made with full knowledge of what runs where.
Every assessment is built in three layers, each carrying a different kind of attestation. The boundary between verified fact and judgment is explicit.
Facts tested against primary sources. Each is cited and checkable, and marked supported, partial, not supported, or unverified.
Reasoning over the verified facts. Each block names the step at which a reasonable reader could disagree.
Proposed actions, each citing the analysis that motivates it. Labelled as proposed, never presented as verified fact.