Where your data lives
This page sets out exactly where your information is stored, what leaves the country and when, and what we do and do not claim. If you are deciding whether to trust a small Australian company with your customer records, you should be able to read the specifics rather than a badge.
Everything you put in is stored in Australia
Your records, your files, your scanned documents and your backups all live in Sydney. Not a global region that happens to include Australia. Sydney.
Your records
Every record, field, note and audit entry. Held in PostgreSQL on AWS in ap-southeast-2, Sydney.
Your files
Uploads, quote and invoice PDFs, and attachments that arrive on replies. All stored in Sydney.
The application
The servers that run StreamsApp and answer every request your browser makes. Sydney.
Document scanning
Scan a document and the text is read by our own service in Sydney, not by an overseas AI provider.
What leaves Australia, and when
Some jobs can only be done well by a specialist provider, and the best ones are based overseas. We would rather list them plainly than let you assume they do not exist.
| What | Provider | Where | When it happens |
|---|---|---|---|
| Sending email | Resend | United States | When you or an automation sends an email from a record. The message, and any PDF attached to it, passes through them. |
| Sending SMS and WhatsApp | Twilio | United States | When you send a message from a record. The message text and the recipient's number. |
| AI features | Google (Gemini) | United States | Only when you use Ask AI, Improve with AI, Suggest with AI, Ask the Lake or the AI stream builder. Ask the Lake sends a summary of your records so it can answer questions about them. |
| Payments | Stripe | United States | Your billing details and card. Your records are never sent to Stripe. |
| Website analytics | Vercel | United States | Page views on our public website. Not your data, and not what you do inside the app. |
| Accounting sync | Xero, MYOB, QuickBooks | Set by that provider | Only if you connect an accounting system yourself, and only the invoices you choose to sync to it. |
The short version: if you do not use the AI features, and you do not send email, SMS or WhatsApp from StreamsApp, then nothing you store with us ever leaves Australia.
How your data is protected
Encrypted both ways
Encrypted in transit with TLS, and encrypted at rest with AES-256.
Separated by organisation
Every record carries the organisation that owns it, and every request is scoped to the organisation of the person signed in.
Strong sign-in
Two-factor codes, passkeys, and a password policy. An admin can require two-factor for everyone in the organisation.
A full audit trail
Every change records who made it, when, and what the value was before and after. Admins can read and export it.
Nothing is hard deleted
Archiving a record puts it out of the way rather than destroying it, so a mistake stays recoverable.
Your data stays yours
Export your whole organisation at any time, in standard file formats, at no charge.
What we do not claim
Plenty of software puts certification logos on a page without the audit behind them. Here is our honest position.
We are not ISO 27001 certified, and we are not SOC 2 audited
Both are independent audits of a company, its policies and its evidence, not something a piece of software can hold on its own. We have not done either, and we are not going to imply otherwise by putting a logo here.
The ground we stand on is certified
StreamsApp runs on AWS and Google Cloud (both ISO 27001 and SOC 2 Type II), Vercel (SOC 2 Type II), and Stripe (PCI DSS Level 1). That covers the data centres and the platform underneath us. It does not transfer to our own processes, and we will not pretend it does.
We handle personal information under Australian law
The Privacy Act and the Australian Privacy Principles, including the rules on disclosing personal information overseas. That is precisely why the table above exists and names every provider.
Questions we get asked
- Do you use our data to train AI?
- No. StreamsApp does not train any model on your data, and we never pool one organisation's information with another's. The AI features send your question, and only the records needed to answer it, to Google's Gemini API. We use the paid tier of that API, where Google's terms state they do not use prompts or responses to improve their products, and retain them only briefly to detect abuse. The free tier does not carry those terms, which is why we do not use it. AI features never run on their own: they run when you press the button, and if you would rather nothing went to an AI provider at all, simply do not use them. Every other part of StreamsApp works without them.
- Where are backups kept?
- With our database provider, in the same Sydney region as the live database. Backups do not leave Australia.
- Who can see our data?
- Inside your organisation, only the people you invite, and only the streams and steps you give them access to. On our side, a small number of platform administrators can reach production data when a support issue genuinely requires it.
- Can we get all of our data out?
- Yes, at any time, without asking us and without a fee. Export produces standard files you can open in a spreadsheet or load into another system.
- What happens to our data if we stop using StreamsApp?
- Tell us and we delete your organisation and everything in it. Until you ask, we keep it, so that coming back does not mean starting again.
- Can you complete our security questionnaire, or sign a data processing agreement?
- Yes. Send it over. We will answer it honestly, including the questions where the answer is no.
Something this page does not answer?
Ask us directly. If the answer is unflattering you will still get it, because you would find out eventually and we would rather it came from us.
Last reviewed 17 August 2026