Data residency

Who this page is for: the IT contact or adviser who wants the residency claim in a form they can test.

The guarantee, enforced

The licensed portal, API and pooled tenant store are deployed in AWS Sydney. The ECS/Fargate runtime and release identities carry explicit Australian-region denies for the services they use. The current repeatable proof exercises a separate user-scoped deny and inventories Sydney resources. Account-wide enforcement and equivalent role-by-role proof for every real-data workload remain readiness checks.

The tested principal receives AccessDenied for the proof’s offshore DynamoDB and S3 calls, while its corresponding Sydney checks succeed. That is useful evidence for the policy pattern; it is not presented as proof that every current or future AWS identity is already covered.

AI processing stays in-region

Refera does not send real referral text or images to an AI model in the current release. The public documentation assistant handles product and support information only and is not a referral-processing path. A future administrative extraction path may use a pinned Amazon Bedrock model in AWS Sydney only after the exact model, regional routing, retention, provider access, logging and fail-closed policy controls are independently proven. It will not perform diagnosis, urgency ranking or treatment recommendation. Administrative process-state only - Refera performs no clinical triage.

Testable, not taken on trust

The proof is re-runnable. deploy/aws/prove-residency.mjs tests the separate proof principal’s offshore denies, inventories bucket regions and selected compute, and verifies that named database, threat-detection and audit resources sit in ap-southeast-2. It prints each PASS/FAIL result and records a dated attestation. A separate readiness check must still prove equivalent coverage for every identity and workload permitted to handle real referral data.

Verified in the audit log too

CloudTrail - AWS’s own audit log - runs multi-region with log-file validation and a Sydney home region, so the practice (or its adviser) can see where each call ran, rather than take our word for it.

The licensed console path

The connected practice console and its API share portal.refera.au, served by AWS ECS/Fargate behind an AWS Application Load Balancer in Sydney. Cloudflare holds the DNS-only record and does not proxy the host. Referral and patient requests therefore terminate on AWS. Cloudflare serves the public website, docs, business-only onboarding/authentication relays and private automated service checks using fictional records and no patient information.

Operational status

This page describes the enforced residency boundary. Live service availability is published at status.refera.au. Real-data handling remains closed unless the capability register marks it Available and every go-live control has passed.

Refera tracks referral admin only. It does not triage patients.

Related

• Sub-processors - AWS, Bedrock and Cloudflare scopes in one table.
• Hosting and isolation - the tenant-scoped shared-service model.