Does HubSpot (incl. Breeze AI) keep data in Australia?
Some data can be kept in Australia. Paid HubSpot accounts can be hosted in Sydney; HubSpot AI (Breeze) providers process Australian-hosted data in the US, and some data and support access sit outside Australia.
HubSpot · CRM and marketing · Plans covered: Starter, Professional, Enterprise · Last checked
What HubSpot says
| Claim | Status | Vendor's words | Source | Last checked |
|---|---|---|---|---|
| Storage at rest | Yes, in Australia | HubSpot’s product infrastructure is hosted on Amazon Web Services (AWS) in the United States (East and West regions), Canada, Australia, and European Union (Germany). HubSpot accounts are hosted in one of these data centers, and customer data is processed and stored in that location. Note: The page's table lists Australia as Sydney. It says "Customer data will also be replicated for disaster recovery and back-up purposes to other data centers within the regional hosting location." Applies to accounts hosted in the Australia data center (paid accounts; see plan_required). Some data is stored or processed outside Australia (see exclusions). | knowledge.hubspot.com | |
| Processing (incl. AI inference) | Partly | Yes. In a very limited number of cases, the processing of customer data can happen outside of your data center location. Note: Core processing is in the hosting location ("customer data is processed and stored in that location"). AI inference is not: on the sub-processors page (last modified September 16, 2026), the HubSpot AI providers Amazon Web Services, Baseten (effective October 16, 2026), Google LLC and OpenAI, the web-search providers Bright Data and Exa, and Hyperdoc (meeting recordings and transcripts) all show "United States" in the Australia Data Center column. The HubSpot AI FAQ says to read that column for where AI providers process data, and that admins can opt out of or manage what these providers process. | knowledge.hubspot.com | |
| Support access | Not in Australia | To assist you, HubSpot staff may access your data from other regions for support and development purposes, in line with the Customer Terms of Service. Note: The same page says employees "from other office locations may access your data to prevent, investigate, monitor, or address security incidents, or misuse of the subscription." The sub-processors page lists HubSpot affiliates for "Services & Support" in the US, Ireland, Germany, Australia, Singapore, Japan, Colombia, Sweden, France, UK, Belgium, Canada, Spain, the Netherlands and India. | knowledge.hubspot.com | |
| Plan required | Paid option | If your account has a Starter, Professional, or Enterprise subscription, you can change your data center. If your account has free tools, you can upgrade to change your data center. Note: Any paid tier (Starter or above). A new paid subscription is assigned a data center by the IP address at sign-up; free-only accounts are assigned the US (hubspot.com/data-centers). Migration has no charge but can only move from US East to another data center, takes about 24 to 36 hours of downtime, and is blocked while HIPAA data is stored (migration help article, updated October 27, 2026). | knowledge.hubspot.com | |
| Exclusions | Partly | Analytics and Usage Data: HubSpot may collect data about how you use and interact with the Subscription Service. This data will be transferred from the hosting location to the United States. Note: The page also lists add-ons, marketplace apps and beta services; Solutions Partners; HubSpot Content (e.g. enrichment data); sub-processors; users accessing from other regions; HubSpot affiliates ("including in the USA"); support; and security staff. For the Australia data center, the sub-processors page shows US locations for HubSpot AI, Google LLC infrastructure ("Infrastructure - Regional Data Processing"), Dropbox e-signature, Litmus email previews, Meta (WhatsApp), Mux video, Stripe payments, Twilio calling and SMS, and reCAPTCHA. The migration article says "Twilio keeps a record of HubSpot customers' phone numbers on their U.S. servers." | knowledge.hubspot.com | |
| IRAP status | Not published | The vendor does not publish a statement on this. Note: The Trust Center badges are SOC 1 Type II, SOC 2 Type II, SOC 3, HIPAA, GDPR, CCPA, EU Cloud Code of Conduct and TRUSTe; IRAP is not listed. The data hosting FAQ says "HubSpot itself is not currently ISO 27001 certified" and relies on AWS controls. Any IRAP assessment of AWS Sydney would be AWS's, not HubSpot's, and was not checked. | trust.hubspot.com |
Why it matters
General information, not a compliance ruling.
- APP 8
- APP 8: sending personal information overseas, including remote access, can be a cross-border disclosure → see storage, processing, support access. Relies on: Storage at rest, Processing (incl. AI inference), Support access
- ISM-1572
- ISM-1572: contract must record processing and storage regions → see storage + processing. Relies on: Storage at rest, Processing (incl. AI inference)
- APRA CPS 230
- CPS 230: offshoring with a material service provider must be assessed and notified to APRA → see storage, processing, support access, exclusions. Relies on: Storage at rest, Processing (incl. AI inference), Support access, Exclusions
- OVIC IPP 9
- IPP 9 (Victoria): personal information may leave Victoria only in set circumstances → see storage, processing, support access. Relies on: Storage at rest, Processing (incl. AI inference), Support access
Changelog
No changes recorded yet.