A supplier can store information in an Australian region while a particular AI deployment processes prompts elsewhere. The words “hosted in Australia” do not, by themselves, identify where inference happens.
Residency is about where information is processed or stored. Retention, monitoring, support access and other providers are related handling questions, but they are not the same thing as residency.
A documented example
Microsoft’s documentation for deployment types in Microsoft Foundry describes a distinction between data at rest and inference. It says data at rest remains in the customer’s chosen Azure geography. A Global deployment may process prompts in any Azure region; a Data Zone deployment processes within its stated zone, such as Asia Pacific. The documented Standard and regional provisioned options keep inference within the selected geography.
That distinction is specific to the service and deployment options described in that documentation. It is not a statement about every AI service, nor does a provider’s published documentation establish which option a particular supplier account uses.
A buyer therefore needs two things: the provider’s description of the option, and evidence of the supplier’s configured option for the relevant feature and date. If the account setting is unavailable, record that limit rather than treating a broad hosting statement as proof of processing location.
What the distinction means for a buyer
An Australian storage location may be relevant to a requirement, but it does not answer where prompts and outputs are processed. Conversely, knowing an inference region alone does not tell you how long monitoring records are retained or which other services receive the content.
The answer depends on the service, feature, deployment option, configuration and evidence date. A finding should say exactly which of those it covers.
Questions that separate the claims
- Where is information stored at rest, and which region setting applies to this account?
- Where are prompts and outputs processed for the feature and deployment option in use?
- What source shows the option selected for this supplier, and when was it checked?
- Are prompts or outputs retained for monitoring or logging, and what are the location and duration?
- Which other providers handle the information, and what do their published materials say?
A useful evidence boundary
Provider contracts, product terms and regional documentation are provider-published evidence. They describe what the provider says it offers or permits; they are not automatically an independent audit of a supplier’s live configuration.
Third-party assessment material can add another perspective, but its scope and date matter too. Keep the claim, the source, the configuration evidence and the remaining uncertainty visible as separate parts of the record.
