Legal software data residency in Australia: where your firm's matter data actually lives

Data residency is the question of which country your matter data is stored and processed in, including backups and AI processing. The checkable version of that question names a region, not a country in marketing copy. MatterFirst, for example, stores data in the AWS region a firm chooses, Sydney by default, and runs document extraction in that same region.

Most Australian firms ask a vendor one question about this: "is our data held in Australia?" The answer is almost always yes, and it is almost always incomplete. A practice management platform is not one store of data. It is a database, a document store, a backup and disaster recovery copy, a search index, an email and calendar connection, a set of AI services, an error and telemetry pipeline, and a support team who can see into your workspace. Each of those can sit in a different country. "Hosted in Australia" usually describes the first one.

This article sets out what to ask instead, how to verify the answers, and what the major Australian practice management vendors publish about it today.

What "hosted in Australia" actually needs to cover

Break the question into the six places matter data comes to rest or passes through. Ask about each one separately, because a vendor can answer honestly about the database and still be moving your documents through a service in another country.

The last two are where most surprises live. A platform can be hosted entirely in Sydney while its optical character recognition runs in Virginia, its error monitoring in Ireland and its support engineers in three time zones. None of that is improper, but it should be a decision rather than a discovery.

Why an Australian firm should care beyond a compliance box

Three reasons, in descending order of how often they actually bite.

Client and institutional requirements. Government panels, insurers, banks and larger corporate clients increasingly specify onshore hosting in their supplier terms. Firms doing this work need a straight answer with a region name in it, because the client's procurement team will ask for one.

Privacy obligations. The Australian Privacy Principles do not prohibit storing personal information overseas. APP 8 instead sets conditions on cross-border disclosure, requiring reasonable steps before disclosing personal information to a recipient who is not in Australia, and APP 11 requires an entity that holds personal information to "take such steps as are reasonable in the circumstances to protect the information from misuse, interference and loss" and from unauthorised access, modification or disclosure. Onshore hosting is one way of narrowing that exposure. It is not the only obligation, and it does not discharge the rest. This is general information rather than legal advice.

Confidentiality and privilege. Every additional jurisdiction a copy of a client file passes through is another legal system that could, in principle, direct a provider to produce it. The useful question is not only "where is the data" but "which legal systems can compel the provider, or its parent company, to hand it over". A vendor that has thought about this can tell you its corporate structure and its subprocessors.

Onshore hosting is not the same as data sovereignty

These two get used interchangeably and they are not the same thing.

Data residency is a location fact: your data sits in a named region. It is verifiable, and a vendor should be willing to put it in a contract.

Data sovereignty is a control question: which country's laws and which company's decisions govern that data. A dataset held in Sydney by a subsidiary of a foreign parent is resident in Australia and still subject to whatever legal process reaches the parent.

Both major Australian public cloud footprints are real and mature. AWS has run its Asia Pacific (Sydney) Region since 2012 and opened a second Australian region in Melbourne with three availability zones, and AWS announced in October 2021 that it had achieved Strategic Hosting Provider certification under the Australian Government's Hosting Certification Framework. So "we host in Australia" is not a differentiator on its own any more. What still differs between vendors is how much of the stack stays there, and whether they will tell you which parts do not.

The AI wrinkle, which is where residency now breaks

Storage residency was largely settled by about 2020. AI processing reopened it. A document sitting in a Sydney bucket can still be sent to a model endpoint in another country the moment someone asks the system to summarise it.

Four questions to put to any vendor selling AI features to Australian firms:

1. Which AI services process our documents, and where does each one run? Extraction, optical character recognition, summarising and chat may use different providers in different regions.
2. Is our content used to train models? Ask for it in writing, for each provider in the chain, not just the vendor's own position.
3. What is retained, and for how long? Prompt and output logs are a copy of client material.
4. Can we turn AI features off per workspace, or per matter? Firms with government or in-house clients often need this at the matter level rather than as a global setting.

A vendor that answers those four with named providers and named regions is doing something meaningfully harder than one that answers "your data is secure and hosted in Australia".

What the main Australian platforms publish today

Verified from each vendor's own published pages while writing this article, in August 2026. Where a vendor does not publish a fact, the cell says so rather than guessing.

Two notes on method. Clio's own pages returned HTTP 403 to our requests while this article was written, so its row reflects its published security page as indexed rather than a page we loaded directly. Absence from this table is a statement about what is published, not about what a vendor does internally: any of these vendors may answer all of it in a security questionnaire, and you should ask.

How MatterFirst handles data residency

MatterFirst is a legal practice management platform for Australian law firms, built by North Cape Technology in Melbourne. Its security page is the authority on the following, and it is worth reading before a trial rather than after.

Matter data, documents, extraction output and AI queries are held in the AWS region the firm chooses, which is Sydney (ap-southeast-2) by default for Australian firms. Backups are held in the same region as the primary data, so a restore does not quietly relocate a firm's files. Data is encrypted at rest and in transit.

AI processing follows the data rather than the other way around. Document extraction and matter questions are processed inside the same AWS region as the documents. There is one named exception, stated rather than buried: document reading uses Azure AI Document Intelligence in Azure's Australia East region, which is still in Australia but is a different provider, and a firm evaluating subprocessors should know that.

Access controls are matter-level rather than account-level: role-based permissions, a matter-level audit trail, privileged document handling, central account control and an automation run log. Where a firm connects an external AI assistant such as Claude or ChatGPT to its workspace through the MCP server, that connection is off until an administrator switches it on, and it carries per-connection permission profiles, Australian identifier masking and per-tool approval.

Two limits worth stating plainly. MatterFirst does not hold SOC 2 or ISO 27001 certification, and says so on its security page; the argument it makes instead is that the controls are testable directly in a trial. And its trust accounting compliance review workflow covers NSW, VIC, QLD and WA, which is four jurisdictions rather than all eight, although matters can be recorded in all eight. Data and documents are exportable on exit.

Pricing is per workspace rather than per user, from $199 per month per workspace with users included, and each paid plan includes a monthly AI balance in Australian dollars that metered AI work draws down. Deterministic work, such as generating a document from merge fields and clause library entries with no AI section in it, draws down nothing. The pricing and AI metering pages carry the current rates.

Who this suits, and who it does not

MatterFirst suits Australian firms of roughly two to twenty fee earners that want a named onshore region for both storage and AI processing, state-based trust accounting in NSW, VIC, QLD or WA, and document generation that is deterministic by default.

It suits you less well if a client or panel requires a SOC 2 report or ISO 27001 certificate as a precondition, because MatterFirst does not hold either today. It also suits you less well if your workflow depends on a connector that is not yet available. Only four integrations are connectable today: Xero, Stripe, Microsoft 365 and Google Workspace. PEXA, InfoTrack, MYOB, QuickBooks Online, SharePoint, OneDrive, Dropbox, Teams, Slack, Zapier, Make, Salesforce, HubSpot, DocuSign and iManage are listed as coming soon, and anything else needs the documented REST API with webhooks. For a conveyancing practice that settles through PEXA daily, that is a real constraint to weigh now rather than discover in week three.

Put it in the contract, not just the sales call

Verbal assurances about hosting do not survive staff turnover at either firm. Four things worth getting in writing:

1. The named region, not the country. "AWS ap-southeast-2" is enforceable in a way that "Australia" is not.
2. Notice before a region or subprocessor changes, with a defined notice period and a right to exit if you do not accept the change.
3. A subprocessor list you can subscribe to, so a new AI provider in the chain is a notification rather than an archaeology project.
4. Export on exit, in a documented format, within a stated number of days, without a fee that only appears when you leave.

If you are running a formal comparison, the evaluation checklist sets out the questions to put to any vendor, including the ones MatterFirst answers least well.

Frequently asked questions

Does my law firm's data have to be stored in Australia? No. The Australian Privacy Principles do not prohibit storing personal information overseas. APP 8 sets conditions on cross-border disclosure and APP 11 requires reasonable steps to protect information you hold. Onshore hosting is one way of narrowing that exposure. Separately, some clients, panels and insurers impose onshore hosting as a contractual requirement, and that is usually the binding constraint in practice.

Where does MatterFirst store Australian firms' data? In the AWS region the firm chooses, Sydney (ap-southeast-2) by default for Australian firms, with backups in the same region.

Does MatterFirst send documents to an overseas AI model? Its security page states that document extraction and matter questions are processed inside the same AWS region as the documents, and that document reading uses Azure AI Document Intelligence in Azure's Australia East region. Both of those are in Australia.

Is onshore hosting the same as data sovereignty? No. Residency is where the bytes sit. Sovereignty is which laws and which company control them. Ask about corporate structure and subprocessors as well as region.

Does MatterFirst have SOC 2 or ISO 27001? No. Its security page states it holds neither, and points to controls a firm can test during a trial instead. If a client requires either certificate, ask about it early.

Does MatterFirst handle Victorian trust accounting? Yes. The trust accounting compliance review workflow covers NSW, VIC, QLD and WA. Matters themselves can be recorded in all eight Australian jurisdictions.

What should we ask a vendor if we only have time for one question? "Name every service that touches our documents, and the region each one runs in." A vendor that can answer that in one email has thought about residency properly. A vendor that cannot will tell you the data is encrypted, which is true of everyone and answers a different question.

The short version

Ask for region names rather than country names, and ask about the database, documents, backups, AI processing, subprocessors and support access separately, because those six can and do differ. Treat AI features as a residency question rather than a feature question, since that is where matter content most often leaves the country. Then put the answers in the contract, with notice rights when they change.