AI data residency in Australia: where ChatGPT, Claude, Copilot and Gemini keep your data

AI data residency in Australia comes down to two separate questions: where your prompts, files and chat history are stored, and where the AI model processes them. As of October 2026, several major AI tools can store business data at rest in Australia, but far fewer process it here. This guide sets out what each vendor publishes, plan by plan, with a link to the source for every claim.

The short answer (October 2026)#

• ChatGPT: New ChatGPT Enterprise and Edu workspaces, and approved OpenAI API projects, can store data at rest in Australia. OpenAI doesn't offer Australian processing: its inference residency covers Europe, the United States and the UAE. ChatGPT Free, Plus and Business have no Australian option.
• Claude: Anthropic's own apps and API have no Australian option. The API runs inference globally or in the US, and stores workspace data in the US. Claude on Amazon Bedrock, called through the Australian inference profile, is processed only in Sydney and Melbourne.
• Microsoft 365 Copilot: For tenants provisioned in Australia, Microsoft commits to storing Copilot interaction content at rest in Australia. Processing can happen in other regions. Microsoft expects to offer in-country processing in Australia by the end of 2026, and Anthropic models used in Copilot are excluded from that commitment.
• Gemini: Google Workspace data regions offer only the United States or Europe. Developers calling Gemini models on Google Cloud can have some models processed in Sydney.

To compare the options you're considering side by side and export the result, use the free AI data residency checker.

Stored, processed and accessed: three different questions#

"Data residency" gets used loosely. When you assess an AI tool, ask three questions separately.

1. Where is data stored at rest? Saved conversations, uploaded files, memory, custom assistants and backups. This is what most residency commitments cover. Microsoft's, for example, covers "any stored content of interactions" with Copilot.
2. Where is it processed? For AI, the key processing step is inference: the model reading your prompt and documents and generating a response. A tool can keep your chat history in Sydney while sending every prompt to a model running overseas. OpenAI's help centre spells this out: data residency controls storage, inference residency controls where GPU inference runs, and even with inference residency some CPU processing (such as extracting text from uploaded files, routing and authentication) can happen outside the region.
3. Who can access it, and from where? Support engineers, abuse reviewers and subcontractors may be able to reach your data from other countries. OpenAI says ChatGPT Business conversations can be accessed by authorised employees and by specialised third-party contractors reviewing for abuse. Microsoft says its engineers have no standing access to Microsoft 365 customer data, and any access is approved case by case. On Amazon Bedrock, model providers such as Anthropic have no access to customer prompts and completions.

Metadata matters too. Most commitments exclude account details, billing information, usage statistics and logs without content, which can sit outside Australia even when your content doesn't.

AI data residency by tool and plan#

As of October 2026. "No Australian option published" means we couldn't find one in the vendor's documentation. Check the sources below for changes.

ChatGPT data residency in Australia#

Australia has been one of OpenAI's data residency regions since an expansion OpenAI announced in November 2025. Its help centre says eligible API customers and new ChatGPT Enterprise and Edu customers can have in-scope content stored at rest in Australia. That covers conversations (text, image and voice), uploaded files, custom GPTs, ChatGPT memory, data analysis artifacts and image generation, plus backups. It is included at no extra cost on Enterprise and Edu.

What it doesn't cover:

• Processing. Inference residency, which keeps GPU inference in-region, is available only for Europe, the United States and the UAE. In Australia, your workspace is stored here and processed elsewhere.
• Some data. Workspace metadata, billing information, user logins, transient processing and anything sent to external integrations (apps, MCP servers, web search) can be stored outside the region.
• Some features. Beta features, third-party GPTs and Codex Web are not eligible.

Workspace owners can confirm the setting under Workspace settings > General, in the "Data Residency Region" field. ChatGPT Business doesn't offer data residency: OpenAI's pricing page marks it as an Enterprise feature.

On the OpenAI API, Australia (au.api.openai.com) is listed for storage but not regional processing, and OpenAI says it may process and temporarily store content outside a region that doesn't support regional processing. Regions outside the US also require approval for abuse monitoring controls.

Claude data residency in Australia#

Anthropic's own platform has two settings. Inference geo is either global (the default, any available geography) or us. Workspace geo, which sets where API data is stored at rest, is currently us only and can't be changed after the workspace is created. There's no Australian option, and Anthropic doesn't publish one for the Claude apps (Free, Pro, Max, Team or Enterprise) either. Its regional compliance page points customers who need regional storage and processing to AWS Bedrock, Google Cloud Vertex AI and Microsoft Foundry.

Amazon Bedrock is the route to Claude processed in Australia. In October 2025 AWS introduced an Australian cross-region inference profile that routes Claude requests only between Sydney and Melbourne. Two details matter:

• The profile you call decides where processing happens. Geographic profiles (au.) stay within Australia. Global profiles can route to any supported AWS Region worldwide, at a lower price.
• You can verify it. AWS records every cross-Region request in CloudTrail in your source Region, with a field showing the Region that processed it.

Bedrock also states that inputs and outputs aren't shared with model providers or used to train models. Not every Claude model is available on the Australian profile, and new models may arrive later than on Anthropic's own apps. Read more about using Claude in Australia.

Copilot data residency in Australia#

Microsoft's Product Terms commit that, for tenants provisioned in Australia, Microsoft stores certain data at rest only in Australia. Since 1 March 2024 that includes stored content of interactions with Microsoft 365 Copilot, and since 1 September 2025 Copilot Chat. Microsoft is renaming these Microsoft Copilot and Copilot Chat, with no change to its commitments.

Processing is different. Microsoft's Copilot privacy documentation says calls to the model go to the closest data centres but can go to other regions when demand is high, and that customers outside the EU may have their queries processed in the US, EU or other regions.

• In-country processing: In November 2025 Microsoft announced it would offer Australian customers in-country processing of Copilot interactions by the end of 2025. An April 2026 update revised this: Microsoft now expects it to be available in Australia by the end of 2026. It covers prompts and responses from Copilot models hosted on Azure OpenAI.
• Anthropic models: Claude models in Copilot are on by default for most commercial tenants outside the EU, EFTA and UK, which includes Australia. Microsoft says they are currently excluded from in-country processing commitments. Admins can turn them off under "AI providers operating as Microsoft subprocessors" in the Microsoft 365 admin center.
• Web search: Microsoft says web search queries that Copilot Chat sends to Bing are covered by the Microsoft Services Agreement and Privacy Statement, with Microsoft as an independent data controller, rather than by the Product Terms. Check how web search is handled for Microsoft 365 Copilot too.
• Education tenants: Microsoft's Product Terms let it store Office 365 Education data at rest anywhere in the EU or North America for education tenants outside the EU or EFTA that haven't bought Advanced Data Residency for Education. Schools and universities should check which terms apply to them.

Gemini data residency in Australia#

Google Workspace data regions let admins on supported editions store covered data in the United States, Europe or "no preference". There's no Australian region, and data region settings don't apply to Gemini Notebook.

Developers using Gemini models on Google Cloud (Vertex AI, which Google's documentation now calls Gemini Enterprise Agent Platform) can choose where data is stored at rest. Google lists Sydney (australia-southeast1) as supporting in-region processing for some models, including Gemini 3.5 Flash, when you call the regional endpoint. Global endpoints can process requests anywhere and carry no residency guarantee.

What onshore processing doesn't change: the US CLOUD Act#

Data residency is about where data sits. Jurisdiction follows the company that holds it.

The US CLOUD Act, enacted in March 2018, amended the Stored Communications Act. According to the US Department of Justice, it clarifies that providers subject to US jurisdiction must disclose data in their "possession, custody, or control" in response to valid US legal process, regardless of whether the data is located inside or outside the United States.

OpenAI and Anthropic are headquartered in the United States, as are Microsoft, Google and Amazon Web Services. Storing or processing data in Sydney or Melbourne doesn't take it outside the reach of US legal process directed at those providers. That applies to AusGPT too: we run on AWS infrastructure in Australia, and AWS is a US company.

Australia and the United States also have a CLOUD Act agreement. According to the Attorney-General's Department, the AUS-US Data Access Agreement was signed on 15 December 2021 and entered into force on 30 January 2024. It lets each country's law enforcement and national security agencies obtain orders for data held by communications providers in the other country without separate review by their own government. Orders must relate to offences punishable by at least three years' imprisonment and require independent review or oversight, and US authorities can't intentionally target Australian citizens, permanent residents or people in Australia under the agreement.

None of this makes residency pointless. Keeping data and processing in Australia limits how many countries' infrastructure your data passes through, simplifies cross-border assessments and answers the first question many boards and clients ask. But if your risk assessment depends on no foreign government being able to compel access, residency alone won't meet it. Measures such as minimising what staff put into AI tools and reviewing a provider's terms on government requests also matter. Get advice for your situation.

Under the Privacy Act, APP 8 doesn't ban sending personal information overseas. Before disclosing it to an overseas recipient you must take reasonable steps to ensure the recipient doesn't breach the APPs, and under section 16C you can remain accountable for what the recipient does. The OAIC's guidelines explain when giving data to an overseas cloud provider can be a "use" rather than a "disclosure".

How to check a vendor's data residency claims#

• Ask the three questions separately. Where is content stored at rest, where is inference run, and who can access it from where? A "yes" to the first says nothing about the other two.
• Find the commitment, not the marketing. Look for the clause in the product terms, data processing addendum or help centre that names Australia, and note what it covers.
• Check eligibility and timing. Residency may apply only to certain plans, to new workspaces, or to tenants provisioned in Australia, and it may have to be chosen at setup.
• Read the exclusions. Metadata, logs, web search, connectors, third-party models, beta features and support access are common carve-outs.
• Check the model list. Regional processing often covers only some models. Confirm the model your team actually uses.
• Verify in the console. OpenAI shows the region in workspace settings, Microsoft 365 shows a data location card in the admin center, and Bedrock logs the processing Region in CloudTrail.
• Ask about subprocessors. A tool built on another company's model may send data to that company, or may not. Ask where each subprocessor processes your data.
• Diarise a re-check. These settings changed several times in the past year.

Our security page explains where AusGPT stores and processes your data.

How we keep this guide up to date#

Every fact on this page and in the AI data residency checker was checked against the vendor's own documentation, help centre or terms on 9 October 2026, and each is linked below. Where a vendor doesn't publish something, we say so rather than infer it. We don't rely on reseller blogs or news reports for vendor facts. We re-check every row before each update and change the date at the top of the page. If you spot something that has changed, let us know.