Sovereign cloud hosting in Australia
Sovereign cloud hosting means your servers and data stay physically in Australia, under Australian privacy law, in Tier III+ Australian data centres, Sydney by default and other Australian locations on request.
Virtual servers, storage and backups in Australian data centres (Sydney by default, other Australian locations on request), run by a Sydney team with 24/7 emergency support.
- Production and backups onshore
- 99.99% uptime SLA
- 24/7 emergency support
- Since 2003
- Definition
- hosting with Australian data residency and reduced foreign control risk versus offshore-only hyperscale
- Focus
- Australian soil, Privacy Act-minded design, Tier III+ class facilities
- Not the same as
- “an AWS region in Sydney” alone (residency ≠ full sovereignty story)
- Operator
- Australian-owned operators with no foreign parent
- Backups and DR
- Daily backups plus a second Australian facility for disaster recovery
What the platform is built on
Where the data lives, what it runs on, and who looks after it.
100% Australian Data Residency
All data, backups, and replicas physically reside within Australia. The operator has no foreign parent, so the US CLOUD Act does not reach it.
Built for Australian obligations
Designed around the Privacy Act’s Australian Privacy Principles and ISM-aligned controls, for government contractors, legal firms and medical practices. Design support, not a legal certificate.
Enterprise NVMe Performance
NVMe SSD storage on every tier.
Tier III & IV Data Centres
Australian facilities with N+1 power, cooling and connectivity, Sydney by default. 99.99% uptime SLA in the contract.
Automated Backup & DR
Nightly backups with configurable retention, plus geo-redundant disaster recovery to a second Australian facility, in Sydney or another Australian location, all within Australian borders.
Dedicated Local Support
A Sydney-based engineer looks after your account. 24/7 emergency support.
Private Networking
Dedicated private VLAN connectivity between your cloud and data centre environments, so no traffic crosses the public internet.
Flexible Compute & Storage
Virtual machines and storage sized to the workload, changed up or down as it grows or shrinks.
Who needs this
Government contractors working to IRAP controls, health providers holding patient data, and legal firms holding client files. We design to these frameworks; your own obligations still need your own assessment.
Why Not Just Use AWS Australia?
AWS, Azure, and Google have Australian data centres, but as US companies they remain subject to the US CLOUD Act. US authorities can compel a US provider to hand over your data under the CLOUD Act, regardless of where it is stored.
Our sovereign cloud has no foreign parent. Your data is governed by Australian law, managed by Australians, in Australian facilities.
Why Australian hosting, not a US cloud with an Australian region
Many businesses keep claim files, client documents, photos and other personal information in US-owned services such as Dropbox. Choosing an Australian region puts the files on Australian soil. It does not change who owns the operator.
On this page: Who can compel access · Dropbox, OneDrive, Google Drive · Privacy Act · Sector rules · Moving off Dropbox · What it does not do
Who can be compelled to hand over your files
| US-owned provider, Australian region | Australian-owned operator, no foreign parent | |
|---|---|---|
| Where the files sit | In Australia | In Australia |
| US CLOUD Act orders | Reach the US parent, wherever the data is stored | Not served on a US parent, because there is none |
| Australian warrants and courts | Apply | Apply |
| Law the operator answers to | Australian law and US law | Australian law |
| Backups and disaster recovery | Check the region of every copy and replica | Production and backups stay in Australia, with a second Australian facility for recovery |
The US-Australia CLOUD Act agreement (signed 15 December 2021) is a separate route. It lets each country's authorities serve orders for serious crime, generally offences carrying at least three years' imprisonment, on providers in the other, with limits that include not targeting the other country's nationals or residents.
Dropbox, OneDrive and Google Drive compared
| Service | Owner | Location options (vendor documentation, checked 16 October 2026) | US CLOUD Act reach |
|---|---|---|---|
| Dropbox | US company | Depends on your plan, so check which storage regions it offers you | Reaches the US parent, whatever the region |
| Microsoft OneDrive and SharePoint | US company | Australia is a Microsoft 365 Multi-Geo location. The add-on is not currently available to small business subscriptions | Reaches the US parent, whatever the region |
| Google Drive | US company | Google's data regions policy lists United States, Europe or no preference. Australia is not listed on that page | Reaches the US parent, whatever the region |
What the Privacy Act 1988 says about location
| Provision | What it requires | Effect of Australian hosting |
|---|---|---|
| APP 8, cross-border disclosure | Before personal information goes to an overseas recipient you must take reasonable steps to make sure it is handled in line with the APPs | Stored data has no overseas recipient to assess |
| Section 16C | You remain accountable for the overseas recipient's handling of that information | Not triggered by storage that stays in Australia |
| Notifiable Data Breaches scheme (Part IIIC) | Assess a suspected eligible breach quickly, and notify the OAIC and affected people if serious harm is likely | You deal with a local operator and a local support team |
Where location is written into the rules
| Sector or data | Rule | What it means for hosting |
|---|---|---|
| My Health Record data | My Health Records Act 2012, section 77, headed "Requirement not to hold or take records outside Australia" | Check whether it applies to your own records before relying on it |
| APRA-regulated insurers, banks and super funds | CPS 234 (information security) and CPS 230 (operational risk) | Both cover the use of service providers, so you need to know where and by whom your data is handled |
| Government contractors | IRAP assessments and the Information Security Manual | Set by the contract and the classification of the data |
| Insurance claim files, legal documents, other personal information | No general rule that data must stay in Australia | A risk decision, and an APP 8 question if it goes offshore |
Checked against OAIC, APRA and legislation.gov.au on 16 October 2026. This is not legal advice. Your own obligations need your own assessment.
Moving files off Dropbox, OneDrive or Google Drive
| Step | What happens |
|---|---|
| 1. Inventory | Folders, users, shared links and storage size are listed before anything moves |
| 2. Permissions | Who can see and edit what is mapped across, so access matches the old service |
| 2b. Product specifics | OneDrive and SharePoint sites, Teams files and sharing links, or Google shared drives and link sharing, are each listed and mapped on their own |
| 3. Copy | Files are copied, with version history where the source service supports it |
| 4. Cutover | Done in an agreed window outside your trading hours |
| 5. Rollback | A written rollback path exists before the first file moves |
| 6. Retire | The old service is switched off or locked only after the cutover is checked |
What Australian hosting does not do
- It does not stop Australian agencies using lawful warrants.
- It does not replace encryption, strong passwords or access control.
- It does not make you compliant by itself. Your obligations stay yours.
Cloud Hosting Plans
Indicative tiers. Every environment is sized to the workload. Contact us for a quote.
Foundation
SMBs and professional practices getting started with cloud hosting
- 4 vCPU
- 16 GB RAM
- 500 GB NVMe
- 2 TB monthly transfer
- Daily backups
Professional
Established businesses with compliance requirements and multiple systems
- 16 vCPU
- 64 GB RAM
- 2 TB NVMe
- 10 TB monthly transfer
- Hourly backups + DR replica
Enterprise
Government contractors, healthcare, and high-availability workloads
- Custom vCPU
- Custom RAM
- Custom NVMe storage
- Custom transfer
- Multi-site DR + SLA
How a migration runs
A planned cutover with a rollback path, scheduled around your trading hours.
Requirements Review
We assess your current hosting environment, compliance obligations, and workloads to design the right sovereign cloud architecture for your organisation.
Migration Planning
A written migration plan with cutover steps and a rollback path, scheduled around your trading hours.
Environment Build
Your sovereign cloud environment is built, hardened, and tested in an Australian data centre of your choice, Sydney by default. We configure networking, backups, and monitoring before any data moves.
Migrate & Go Live
We move the systems, check every service, then cut over. Monitoring, backups and patching carry on from there.
What working with us looks like
Infrastructure in Australian data centres, with documentation you can hand to a client or auditor asking exactly where the data lives.
Discovery, a written cutover plan, then a built and tested environment, and only then the move.
We work to the compliance position you actually need, and say plainly where a requirement is not met.
Monitoring, backups and patching handled by the same team that designed the environment.
What is Australian Cloud Hosting?
It means your data and infrastructure sit physically in Australia under Australian privacy law. With an Australian-owned operator that has no foreign parent, there is no US parent for a CLOUD Act order to be served on.
Does the US CLOUD Act apply to OneDrive and SharePoint in an Australian region?
Microsoft is a US company, and the CLOUD Act reaches US providers wherever the data is stored. Microsoft offers Australia as a Multi-Geo location, which sets where the data sits, not who owns the operator.
Can Google Drive keep our files in Australia?
Google's data regions policy lists the United States, Europe or no preference, and Australia is not listed on that page. Google is also a US company, so the CLOUD Act reaches it wherever the files sit.
Does the US CLOUD Act apply to files in Dropbox's Australian region?
Dropbox is a US company, and the CLOUD Act reaches US providers wherever the data is stored, so an Australian region does not remove it. An Australian-owned operator with no US parent has no US parent to serve.
Does the Privacy Act require personal information to stay in Australia?
There is no general rule. APP 8 makes you accountable for personal information that goes to an overseas recipient. Some sectors do have location rules, such as My Health Record data under section 77 of the My Health Records Act 2012. Keeping data in Australia removes the overseas question.
What happens to our files when we move off Dropbox?
We list your folders, users and shared links, map permissions, copy the files, and cut over in an agreed window. A written rollback path exists before anything moves, and the old service is retired only after the cutover is checked.
What is sovereign cloud in Australia?
Sovereign cloud means the data, the operator and the legal control stay in Australia, not merely a Sydney region of a US hyperscaler. eWEB TEC hosts on Australian soil with no foreign-hosted production. Guide: https://ewebtec.com/blog/what-is-sovereign-cloud
Why does Data Sovereignty matter?
Where your data sits decides which laws and courts can reach it. Some sectors have written location rules, such as My Health Record data and APRA-regulated entities using service providers. For most personal information there is no blanket rule, but APP 8 makes you accountable for anything that goes to an overseas recipient. Australian hosting with no foreign parent keeps that question simple.
Where are your servers physically located?
Our cloud infrastructure is housed in Tier III and Tier IV certified data centres located within Australia. Sydney is the default, and other Australian locations are available on request.
Do you offer backup and disaster recovery?
Yes. Automated backups and disaster recovery, all inside Australia. DR replicas are held in a second Australian facility, in Sydney or another Australian location.
Can you migrate our existing systems to sovereign cloud?
Yes. Assessment, planning, build and cutover, with a rollback path and the move scheduled around your trading hours.
How is Australian cloud hosting different from AWS or Azure?
AWS, Azure, and Google Cloud have Australian regions, but your data may still traverse or be accessible through foreign parent companies under US law. Our cloud is run by an Australian operator with no foreign corporate parent, and production and backups stay onshore.
What compliance frameworks do you support?
We support the Australian Privacy Act, IRAP-aligned controls, the Information Security Manual (ISM), healthcare privacy standards, and ASD Essential Eight. Our data centres hold ISO 27001 certification.
Ready to talk?
Call +61 407 453 817 or send a message and we will call you back.
Artarmon NSW 2064 · Narrabeen NSW 2101 · Sydney data centres 24/7