Your data in Australia: what to ask any software vendor
Valuation files hold personal and financial details. The questions to put to any software vendor about where data lives and who can see it, and our own answers, overseas providers included.
By Valufield6 min read
A valuation file is full of other people's information: owners' and occupiers' names, phone numbers, access notes, family law matters, estates, super funds and fees. When a firm moves that work into software, it hands the information to a vendor, and usually to that vendor's suppliers too. "Is the data stored in Australia?" is the question most people ask. It is a good start, and it is not enough.
This guide lists the questions we think every valuation firm should put to a software vendor, including us, and then answers them for Valufield, including the parts that happen overseas.
It is general information, not legal advice.
Why it matters for a valuation firm
Many small businesses are outside the Privacy Act: a business with an annual turnover of $3 million or less is generally exempt unless an exception applies. But your clients may not be. Law firms, accountants and lenders who instruct you often are covered, and they will ask how you handle what they send.
When an organisation covered by the Act sends personal information overseas, Australian Privacy Principle 8 generally leaves it accountable for how the overseas recipient handles it. The Office of the Australian Information Commissioner has plain guidance on sending personal information overseas. Knowing which of your vendors' suppliers are overseas is part of answering your own clients honestly.
Ten questions to ask
Where is the main database hosted, and where are the backups? Ask for the provider and the region, not just a country.
Where do the application servers run? The database can be in Sydney while the servers that read it are elsewhere.
Which other companies handle our data, and where? Email delivery, payments, error tracking, AI features and phone systems are usually separate suppliers. Ask for the list.
What leaves the country, and why? Almost every cloud product sends something overseas. A vendor who says "nothing" has either checked very carefully or not at all.
What do the AI features send, and to whom? Ask what text is sent, whether the supplier keeps it, and whether it is used to train models. Ask for the answer in writing.
How is our data kept apart from other customers'? Most software serves many firms from one system. Ask how the separation is enforced and how it is tested.
Who at the vendor can see our data? Support staff access should be limited, logged and visible to you.
How do we sign in, and who can do what? Two-step sign-in, roles for different staff, and a record of changes that cannot be edited.
How do we get everything out, and what happens when we leave? An export you can use, and a clear deletion process.
What happens if something goes wrong? Ask whether the vendor will tell you about a data breach and how quickly, and whether it follows the Notifiable Data Breaches scheme.
A change worth knowing about: from 10 December 2026, privacy policies must describe automated decisions that could significantly affect individuals. If a vendor's AI features score calls or rank anything about people, ask how that is disclosed.
Our answers
Here are Valufield's answers to the same questions, as the product stands today.
Where your records live
Valufield's database, sign-in, file storage and backups are hosted by Supabase on Amazon Web Services in Sydney, the ap-southeast-2 region. The application's server functions run on Vercel in its Sydney region. Supabase staff may access the service from other countries for support and operations, under Supabase's own terms.
What happens overseas
We will not tell you all your data stays in Australia, because it does not. These providers handle some information outside Australia:
Vercel runs the application in Sydney, but keeps builds, request logs and cached pages in the United States and on its global network.
Stripe processes subscription payments and, if you connect your own Stripe account, your clients' card payments, in Australia, the United States and other countries where its affiliates operate.
Resend sends sign-in, notification and campaign email, and stores email data in the United States.
Anthropic provides the AI features, such as answering staff questions from your firm's knowledge base, and processes that text in the United States and possibly other countries. For a knowledge base answer, only the question and the most relevant passages from your own knowledge base are sent, and nothing is sent if nothing relevant is found. In a valuation job, the AI features send Anthropic only the text of the section being drafted, the template guidance and the facts the valuer has confirmed and allowed AI to see; for document reading, the text of the pages you choose to read. Every AI request carries only the text that task needs.
Some providers are used only when a feature is switched on: Twilio for phone numbers and SMS and ElevenLabs for call transcription and voice features, both off at launch, and Cloudflare's bot protection on public forms, all in the United States or on a global network. Google and Microsoft are involved only when someone connects a mailbox or calendar, or signs in with those accounts.
This list will change as the product does. We are preparing a published list of providers, with what each one does and where it operates, to sit beside our privacy policy.
Keeping firms apart
Every table that holds a firm's data is locked to that firm in the database itself, not just in the application. Automated tests check that one firm cannot read or change another firm's rows.
Access, sign-in and records
Staff can turn on two-step sign-in with an authenticator app, and can sign out their other devices from settings. Roles separate owners, admins and members. An activity log records changes to staff, roles and settings, and it cannot be edited. If our support staff need to look inside your account to answer a support request, the session is time-limited and recorded in that log.
Getting your data out
You can export your clients and any report to CSV, and export your firm's data from Settings at any time. Files you have uploaded are downloaded separately. Your firm owns its data.
AI and your valuations
Valufield's AI features help with admin and with wording. Inside a valuation job, AI can suggest text for descriptive sections of a draft, such as the locality or the condition of the improvements, and the valuer accepts, edits or discards each suggestion. It never writes the value, the rates, the adjustments or the sales evidence, it is never given licensed data such as RP Data or Cotality material, and it is off for court and tribunal reports until the court's leave is recorded on the job. Firms can turn most of the AI features off.
A fair way to compare vendors
Put the same ten questions to every vendor, in writing, and compare the answers side by side. Watch for vague ones: "enterprise-grade security" is not an answer to "where is the database?" A vendor that names its providers and admits what goes overseas is usually one that has actually checked.
For more on how Valufield handles security, see the security page. If you are comparing practice software more broadly, start with what a valuation firm actually needs.
Written by the Valufield team
We build practice software for Australian property valuation firms. Every figure in our posts links to its source, and we only describe what Valufield does today.
