Does Xero (incl. JAX AI) keep data in Australia?
No Australian storage option. Xero hosts its service on AWS servers in the US; no Australian hosting option is published. JAX AI uses third-party LLM providers; their location is not published.
Xero · Accounting · Plans covered: All AU subscription plans, JAX · Last checked
What Xero says
| Claim | Status | Vendor's words | Source | Last checked |
|---|---|---|---|---|
| Storage at rest | Not in Australia | Similar to many software-as-a-service providers, we use Amazon Web Services (AWS), a top-tier, third-party data hosting provider with servers located in the US to host our online and mobile services. Note: No Australian hosting region is published. | www.xero.com | |
| Processing (incl. AI inference) | Not in Australia | When we share personal data, it may be transferred to and processed in countries other than the country you live in—such as Australia, New Zealand and the United States—due to the location of our teams and data hosting locations. Note: For JAX, the Xero JAX page says: "For large language models (LLMs), we use third-party providers like AWS, Microsoft Azure, GCP, OpenAI" and that data "is not retained and isn't used to train the LLMs". The sub-processor list shows Anthropic and OpenAI ("Conversational artificial intelligence services") and AWS, Google Cloud Platform and Microsoft Azure, each with location "United States". The region where JAX inference runs is not published. | www.xero.com | |
| Support access | Not in Australia | The following entities are members of the Xero group and may act as subprocessors to provide support and similar services to you. Note: Listed entities are in New Zealand, Australia, the United States, the United Kingdom, Singapore, Canada and South Africa, plus Syft Analytics entities. Xero's data protection page says customers "can choose to let Xero Support view your data". No Australia-only support option is published. | www.xero.com | |
| Plan required | Not in Australia | Similar to many software-as-a-service providers, we use Amazon Web Services (AWS), a top-tier, third-party data hosting provider with servers located in the US to host our online and mobile services. Note: No plan or add-on offering Australian data hosting is published. The JAX page says "JAX chat is available to all Xero subscribers and users" and that there is "currently no additional charge" for JAX chat. | www.xero.com | |
| Exclusions | Not published | The vendor does not publish a statement on this. Note: Xero publishes no Australian residency option, so there is no exclusions list. The sub-processor list names many United States providers (for example Snowflake, Confluent, Fivetran, Sumo Logic and Twilio), Infosys (India) and CloudFactory (UK). Superchoice (payroll processing) is listed in Australia. | www.xero.com | |
| IRAP status | Not published | The vendor does not publish a statement on this. Note: The security page lists ISO/IEC 27001:2022, SOC 2 reports and PCI DSS v4.0 SAQ A. IRAP is not mentioned on it. A news search result (Canberra Times) suggested Xero is not IRAP-assessed. That is a third party and was not verified on a Xero page. | www.xero.com |
Why it matters
General information, not a compliance ruling.
- APP 8
- APP 8: sending personal information overseas, including remote access, can be a cross-border disclosure → see storage, processing, support access. Relies on: Storage at rest, Processing (incl. AI inference), Support access
- ISM-1572
- ISM-1572: contract must record processing and storage regions → see storage + processing. Relies on: Storage at rest, Processing (incl. AI inference)
- APRA CPS 230
- CPS 230: offshoring with a material service provider must be assessed and notified to APRA → see storage, processing, support access, exclusions. Relies on: Storage at rest, Processing (incl. AI inference), Support access, Exclusions
- OVIC IPP 9
- IPP 9 (Victoria): personal information may leave Victoria only in set circumstances → see storage, processing, support access. Relies on: Storage at rest, Processing (incl. AI inference), Support access
Changelog
No changes recorded yet.