Where Your Website Data Actually Lives

Hosting · Part 3 of 4

Australian hosting is not a defined term. It is a phrase, and on some websites it is doing a great deal of work.

I am not suggesting anybody is lying. I am saying the phrase can be true in four quite different ways, and only one of them is the one you had in mind when you paid.

Four things Australian hosting can mean

One: servers in an Australian datacentre, run by the company you are paying

This is what you assumed. It is also the most expensive of the four to provide, which tells you something about how common it is at the bottom of the market.

Two: an Australian company reselling someone else’s overseas account

The support desk is in Australia. The invoice is in Australian dollars. The server is not here, and the company you are paying cannot get into it any faster than you can.

Three: an Australian registered business with everything offshore

An ABN describes where a company is incorporated. It says nothing at all about where the hardware sits.

Four: an Australian domain name and Australian spelling

Sometimes that is the whole of it.

None of this is exotic. It is the ordinary shape of a market where the customer has no practical way to check.

Your backups may live somewhere else entirely

Here is the one that catches even careful buyers. A server in Sydney with its backups held in Oregon is a normal arrangement, and it is almost never disclosed, because nobody asks.

If it matters to you where your customer information rests, the server location does not answer the question. You have to ask about the backups as a separate item, and you have to ask how long each copy is kept.

What the Privacy Act actually says, and what it does not

The myth first: it is not illegal for an Australian business to host its website overseas. I hear that one constantly and it is wrong.

The real position is more interesting. OAIC guidance on Australian Privacy Principle 8 draws a line between using personal information and disclosing it. Storing or routing personal information through servers outside Australia is usually treated as a use, not a disclosure, where you keep effective control, and that control comes from a binding contract limiting the provider to storage and access.

Read that sentence again with a twelve dollar a month plan in mind. What you have is a click-through terms page you did not negotiate, cannot vary and could not realistically enforce. That is not the arrangement the guidance is describing.

And if it is a disclosure, section 16C keeps you accountable for what the overseas recipient does with the information, even where you took reasonable steps beforehand. Separately, Australian Privacy Principle 11 makes the security of that information your obligation, whoever owns the hardware.

You can outsource the server. You cannot outsource the obligation.

We are not lawyers and this is not legal advice. If you hold health information, financial records or anything government adjacent, get a proper view from someone who is, and get the answers from your host in writing before you sign.

The subcontractors you never agreed to

Your host has an upstream provider. That provider has one too. Add a backup destination, a mail relay, a monitoring service and a support tool that can read your database, and your customer list is touching more companies than you could name if asked.

That is not a scandal, it is how infrastructure works, including ours. The question is not whether there is a chain. It is whether anyone can tell you what is in it.

Four questions, and what a good answer looks like

• Which city is my server in? A city name. Not a region, not a phrase.
• Which legal entity operates that datacentre? A company name you can look up.
• Which country are my backups in, and for how long are they kept? A country and a number of days.
• Which third parties can read my database, and under what agreement? A list, and a document.

A host that knows its own business answers all four in one reply. If it takes a week and comes back vague, that is also an answer, and it is the one you needed.

If your host cannot answer the third one, our managed hosting page states where everything sits, and we will put it in writing.

Where this sits in the series

Part one covered the two things missing from cheap plans, backups and isolation. Part two covered what distance does to a site that has real work to do. Part four does the arithmetic and explains why all of this is predictable rather than unlucky.

Common questions