Financial Services

What are the data residency requirements for financial-services analytics software in Australia?

Quick answer

For an Australian financial-services firm, analytics software should keep customer and financial data onshore, control exactly who can see it, and never send raw data to an AI model offshore. Corvana stores data in Australia (AWS Sydney) with AES-256-GCM encryption, runs on infrastructure assessed at the IRAP PROTECTED level, applies role-based access with per-role financial masking, and routes every AI interaction through an AI Data Firewall that masks PII and coarsens exact figures before any external model call — with a full audit trail that supports obligations such as APRA CPS 230 and CPS 234.

Customer and financial data stored in Australia (AWS Sydney region)

Infrastructure assessed at the IRAP PROTECTED level (region-level assessment)

AI Data Firewall masks PII (ABN, TFN, Medicare, BSB) and coarsens exact financials before any external AI call

AES-256-GCM encryption in transit and at rest; your data is not used to train public AI models

Role-based access with per-role financial masking and a full audit trail — supports APRA CPS 230 / CPS 234 obligations

What "data residency" actually requires

Data residency is more than where a database physically sits. For financial services it means customer and financial data is stored and processed onshore, access is restricted and logged, data in transit and at rest is encrypted, and — increasingly — that data is not shipped to an offshore AI model to generate insights. A tool that charts your numbers but quietly sends raw records to an overseas API does not meet the spirit of residency, even if the primary database is local.

How Corvana keeps financial data onshore

Corvana hosts customer and financial data in Australia (AWS Sydney) with AES-256-GCM encryption, on infrastructure assessed at the IRAP PROTECTED level. Every AI interaction passes through an AI Data Firewall that masks personal and account identifiers and converts exact financial values into ranges before anything leaves for an external model, then un-masks the result locally. Access is role-based with financials masked by role, and every data and AI action is audit-logged.

Mapping to APRA and privacy obligations

Onshore storage, encryption, role-based access and a complete audit trail are the controls that underpin obligations such as APRA CPS 234 (information security) and CPS 230 (operational risk), alongside the Australian Privacy Principles. Corvana is designed to support these obligations rather than claim certification on your behalf — your compliance team keeps the evidence trail it needs.

Frequently asked questions

Is our data ever sent overseas for AI processing?

No raw data. Before any external AI model is called, the AI Data Firewall masks personal and account identifiers (ABN, TFN, Medicare, BSB) and coarsens exact financial figures into ranges; results are un-masked locally. Your data is not used to train public AI models.

Does Corvana meet APRA CPS 234 and CPS 230?

Corvana provides the controls that support these obligations — onshore storage in AWS Sydney, AES-256-GCM encryption, role-based access with per-role masking, and a full audit trail. Certification against APRA standards remains your institution’s responsibility; Corvana supplies the evidence trail.

Where exactly is the data stored?

In the AWS Sydney (ap-southeast-2) region, on infrastructure assessed at the IRAP PROTECTED level, with encryption in transit and at rest.

Corvana for your business

Corvana is an AI-native business intelligence and operations platform built for Australian businesses, unifying POS, accounting, staffing, compliance and valuation data into one real-time command centre.