Ethnobot is built for research in regulated industries, including government. This page gives procurement, security, and legal teams a clear view of data residency, in-region AI processing, residual extra-territorial risk, sub-processors, and compliance documentation — without needing a sales call.
Last updated: 20 October 2026
ap-southeast-2, Sydney).syd1). Core interviews, analysis, synthesis and profiles invoke Claude via Amazon Bedrock in ap-southeast-2 (Sydney / Melbourne au.* inference).au.* inference so model invocation stays in Sydney/Melbourne. That is how banks and agencies usually treat hyperscale AU regions — residency, not sovereignty. AWS is a US-headquartered provider; extra-territorial lawful access risk (including the US CLOUD Act) remains. Ethnobot is not an IRAP-accredited service and is not offered for PROTECTED.Ethnobot operates with an Australia-only storage posture. Participant transcripts, analysis outputs, and profiles are all stored in Sydney. No warm backup outside Australia is part of the active operating configuration. Application compute (Vercel) is pinned to the same region, confirmed via Vercel's deployment record (region syd1) as of 20 October 2026.
| Component | Provider | Location |
|---|---|---|
| Database (transcripts, analysis, profiles) | Supabase (managed PostgreSQL) | Sydney — AWS ap-southeast-2 |
| File storage | Supabase Storage | Sydney — AWS ap-southeast-2 |
| Application hosting | Vercel | Sydney — Vercel syd1 |
| Interview and analysis LLM | Amazon Bedrock (Claude au.* profiles) | Sydney / Melbourne — AWS ap-southeast-2 |
If a contract requires an alternative storage arrangement (for example, a self-hosted deployment in a government-controlled cloud), that can be negotiated up front.
Core interviews, analysis, synthesis, profiles, Express, intake and report chat invoke Claude through Amazon Bedrock in AWS Asia Pacific (Sydney), ap-southeast-2, using Anthropic au.* inference profiles (Sydney and Melbourne only). Org-study voice uses Amazon Transcribe in the same region.
In Australian banking and federal procurement this is described as in-region processing and Australian data residency on a US-headquartered cloud — the same pattern used for many APRA-regulated and OFFICIAL workloads on AWS Sydney. It is not a sovereign Australian cloud, not a Hosting Certification Framework listing for Ethnobot, and not an IRAP assessment of this SaaS. Customers remain responsible for their own APRA CPS 230/234 and PSPF assessments.
Resend (email), Sentry (errors), Axiom (logs), PostHog (product analytics) and Discord (ops alerts) are US-hosted. We keep them on purpose: without them we cannot see outages, send study email, or operate Ethnobot. They are not used to run the interview or analysis model. An Anthropic commercial API key is retained as a fallback if Bedrock is not configured — it is not the live interview path when Bedrock is on.
We do not send core interview traffic to Claude.ai. Bedrock model use is covered by AWS and Anthropic's Bedrock terms. See Anthropic's Privacy Center.
We handle OFFICIAL information only. We do not claim OFFICIAL:Sensitive as a system, PROTECTED, or IRAP accreditation. US-headquartered providers in Australian regions remain subject to extra-territorial lawful access (including the US CLOUD Act). We disclose that residual risk rather than calling Sydney "sovereign."
Some agencies and banks require the workload inside their own tenancy or on an already certified host. That is a scoped embedding project — Ethnobot in the customer's cloud — not the default SaaS.
Ethnobot is self-assessed at Essential Eight Maturity Level 1 across every applicable strategy. Several controls exceed the ML1 baseline — notably the use of phishing-resistant passkey authentication, which is an ML2/ML3-aligned control.
| Multi-factor authentication | Phishing-resistant passkey on every production-path service. Federated SSO via Google or GitHub where applicable; upstream identity providers enforce passkey. Admin dashboard requires password + TOTP. Passkeys stored in 1Password with offline recovery kit. |
| Encryption in transit | TLS 1.2+ on every external connection. |
| Encryption at rest | AES-256 via Supabase managed PostgreSQL. |
| Database access control | Row Level Security enforced on every table. Supabase service-role key is server-side only; never exposed to the client. |
| Application control | Vercel managed serverless runtime. SAST (Semgrep) runs on every push to main and every pull request. Dependencies pinned in package-lock.json; `npm audit` fails CI on high or critical findings. |
| Defensive HTTP headers | X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and X-XSS-Protection configured via next.config.js. Content-Security-Policy rollout is scoped in the next compliance-hardening sprint. |
| Secret scanning | Gitleaks runs on every push to main and every pull request. Any committed secret fails the CI pipeline. |
| Patch management | Vercel and Supabase managed runtimes are patched by provider SLA. Dependency vulnerabilities tracked weekly. |
| Backups | Supabase automated daily backups retained in the Sydney region. Code and schema are version-controlled in GitHub; the database can be rebuilt from migrations. |
| Access register | Every admin account is documented with MFA status and review date. Reviewed quarterly. |
| Vulnerability monitoring | Sentry for application errors (PII masked). Internal security audits recorded in the repository. |
The following providers process data on our behalf. For participant-facing detail, including which data is shared with each, see our privacy policy.
| Provider | Purpose | Location |
|---|---|---|
| Amazon Web Services (Bedrock + Transcribe) | AI interviews and analysis (Bedrock Claude au.*); org-study voice transcription (Transcribe) | Sydney / Melbourne — ap-southeast-2 |
| Anthropic | Fallback only if Bedrock is not configured — not the live interview path when Bedrock is on | United States (transient) |
| Supabase (AWS ap-southeast-2) | Database and file storage — transcripts, analysis, and profiles | Sydney, Australia |
| Vercel | Web hosting and edge CDN | Sydney, Australia (syd1) |
| Resend | Transactional email — kept so we can operate the product | United States |
| PostHog | Product analytics (anonymised usage events) — kept so we can operate the product | United States (EU option available) |
| Sentry | Error monitoring (PII masked) — kept so we can operate the product | United States |
| Axiom | Structured logging (no transcript content) — kept so we can operate the product | United States |
| Discord | Ops alerts when jobs fail — kept so we can operate the product | United States |
Bank deployments can be scoped as an Australia-resident configuration: core interviews and analysis already run in AWS Sydney. Overseas ops processors (email, logging, analytics) are discussed per engagement — they are how we run the product, not the interview path.
The following documents are maintained internally and available to security, procurement, or legal reviewers on request. Email privacy@ethnobot.ai.
For suspected data incidents affecting a client engagement, the client is notified within 24 hours of detection, and a written report is provided within 5 business days. Where an incident engages the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth), the Office of the Australian Information Commissioner is notified in line with statutory obligations.
Privacy, security, and compliance enquiries: privacy@ethnobot.ai
Procurement and commercial discussions: suhit@anantula.com
Privacy Officer: Suhit Anantula, Director, The Helix Lab Pty Ltd. Adelaide, South Australia.