Data residency

Who this page is for: the IT contact or adviser who wants the residency claim in a form they can test.

The guarantee, enforced

The licensed portal, API and pooled tenant store are deployed in AWS Sydney. The ECS/Fargate runtime and release identities carry explicit Australian-region denies for the services they use. The current repeatable proof exercises a separate user-scoped deny and inventories Sydney resources. Account-wide enforcement and equivalent role-by-role proof for every real-data workload remain readiness checks.

The tested principal receives AccessDenied for the proof’s offshore DynamoDB and S3 calls, while its corresponding Sydney checks succeed. That is useful evidence for the policy pattern; it is not presented as proof that every current or future AWS identity is already covered.

AI-assisted extraction stays in Australia

Where a practice’s agreement and activation enable AI-assisted administrative extraction, Refera uses Amazon Bedrock to process recovered referral text, never images. Requests enter through the Sydney runtime endpoint and use Australian inference profiles (au.*), with inference in Sydney and Melbourne.

Rules run first, and the model is used only below the extraction confidence threshold. Haiku 4.5 is the default, with at most one Sonnet 4.6 attempt when Haiku’s result is invalid or a core field (patient name, date of birth, referrer or reason) is unresolved. Extraction returns administrative fields only. A model value is kept only if it appears in the letter. The Medicare number keeps its checksum validation. The model never sets urgency or category: any urgency wording is the referrer’s own, copied verbatim by fixed rules, and category comes only from a labelled field. Refera performs no clinical triage.

For that enabled path, referral text is processed over a private network path, with no internet route for the extraction function. Bedrock data retention is set to “none” in both Australian regions, invocation logging is off, and customer content is not used for training.

The public documentation assistant handles product and support information only and is not a referral-processing path.

Testable, not taken on trust

The proof is re-runnable. deploy/aws/prove-residency.mjs tests the separate proof principal’s offshore denies, inventories bucket regions and selected compute, and verifies that named database, threat-detection and audit resources sit in ap-southeast-2. It prints each PASS/FAIL result and records a dated attestation. A separate readiness check must still prove equivalent coverage for every identity and workload permitted to handle real referral data.

Verified in the audit log too

CloudTrail - AWS’s own audit log - runs multi-region with log-file validation and a Sydney home region, so the practice (or its adviser) can see where each call ran, rather than take our word for it.

The licensed console path

The connected practice console and its API share portal.refera.au, served by AWS ECS/Fargate behind an AWS Application Load Balancer in Sydney. Cloudflare holds the DNS-only record and does not proxy the host. Referral and patient requests therefore terminate on AWS. Cloudflare serves the public website, docs, business-only onboarding/authentication relays and private automated service checks using fictional records and no patient information.

Operational status

This page describes the enforced residency boundary. Live service availability is published at status.refera.au. Real-data handling remains closed unless the capability register marks it Available and every go-live control has passed.

Refera tracks referral admin only. It does not triage patients.

Related

• Sub-processors - AWS, Bedrock and Cloudflare scopes in one table.
• Hosting and isolation - the tenant-scoped shared-service model.