Here's what Xero says on its own website, right now:

Every client file. Every ledger. Every bank feed. Sitting in America.

There is no Australian hosting option for Xero. Not on a higher plan, not as an add-on, not at any price. I went looking.

I'm not picking on Xero. I'm making a point about the order people ask questions in. There are three that matter:

Almost everyone opens with number three. It's the most concrete, it's the easiest thing to say out loud in a board meeting, and it's the least important of the three

Takeaway: Do them in order. The first two are where the actual risk lives

This one confuses people, because "the AI learns" is the entire marketing story of the industry.

Here's what actually happens. A model is a giant pile of frozen numbers, set during a training run that took months on thousands of specialised machines. Once that run finishes, the numbers don't move.

When you send a prompt, your text goes in one side, passes through those frozen numbers, and an answer comes out the other. Nothing gets written back. The model can't change itself because you used it, any more than a calculator learns maths from you pressing buttons.

Microsoft puts it in one line: "The models are stateless: no prompts or completions are stored in the model." Google says the same thing. Foundation models are frozen and only process input to provide output.

So your client data can't leak into a stranger's answer through the model. There's no channel for it. That's architecture, not a promise.

But the consumer and business versions split hard here.

On paid business tiers, no-training is contractual. Anthropic's commercial terms say flat out that they may not train on your content. That's a bar in the contract, not a checkbox someone might tick wrong.

On free consumer tiers it's the opposite. Anthropic changed its consumer terms in August 2025: free and Pro accounts do get used for training when the setting is on, and leaving it on takes retention from 30 days to five years. Google's consumer terms say a subset of chats get read by human reviewers and kept for three years, and their own documentation says that happens even when activity history is switched off.

Same person. Same client file. Completely different outcome depending on which login they used.

Takeaway: The biggest exposure in most firms isn't the AI vendor. It's that nobody gave the team an approved account, so they're using their own.

This is the one worth spending time on, and it's where the phrase "private instance" causes trouble.

Nobody defines that phrase. No vendor uses it as a technical term. It's a sales word bundling four separate things people assume come together: whose contract you're under, whether they train on it, whether they keep a copy, and whether the network path is private. Any one can be true while the others aren't.

Here's the actual ladder.

Rung three is worth understanding, because the mechanism is genuinely clever. AWS doesn't call Anthropic when you send a prompt. They took a copy of Anthropic's software and put it in an account Anthropic cannot log into. AWS says it plainly:

Default posture is zero operator access and zero data retention. Nothing stored, and nobody at AWS can read it either.

One catch that's about three months old and almost nobody has noticed. AWS's newest Claude models won't run at all unless you opt into sharing your data with Anthropic. From AWS's own docs: those models require provider data sharing, and if you don't switch it on, they're simply unavailable to you. When you do, prompts and completions go to Anthropic and are kept 30 days for safety review, including possible human review.

Older Claude models are unaffected. But it means "the model maker never sees your Bedrock data" has gone from a platform guarantee to a per-model thing you have to check. AWS's marketing page still carries the old blanket version. The technical docs say otherwise.

Two things "private" does not mean. It doesn't mean your own copy of the model. Paying for dedicated capacity buys guaranteed speed, not isolation, and AWS describes it purely in tokens per minute. And it doesn't mean nothing is recorded. Every rung except the last logs something under some conditions.

Takeaway: The biggest store of prompts in most organisations is the logging they switched on themselves.

Here's what Xero says on its own website, right now:

Every client file. Every ledger. Every bank feed. Sitting in America.

There is no Australian hosting option for Xero. Not on a higher plan, not as an add-on, not at any price. I went looking.

I'm not picking on Xero. I'm making a point about the order people ask questions in. There are three that matter:

Almost everyone opens with number three. It's the most concrete, it's the easiest thing to say out loud in a board meeting, and it's the least important of the three.

Takeaway: Do them in order. The first two are where the actual risk lives.

This one confuses people, because "the AI learns" is the entire marketing story of the industry.

Here's what actually happens. A model is a giant pile of frozen numbers, set during a training run that took months on thousands of specialised machines. Once that run finishes, the numbers don't move.

When you send a prompt, your text goes in one side, passes through those frozen numbers, and an answer comes out the other. Nothing gets written back. The model can't change itself because you used it, any more than a calculator learns maths from you pressing buttons.

Microsoft puts it in one line: "The models are stateless: no prompts or completions are stored in the model." Google says the same thing. Foundation models are frozen and only process input to provide output.

So your client data can't leak into a stranger's answer through the model. There's no channel for it. That's architecture, not a promise.

But the consumer and business versions split hard here.

On paid business tiers, no-training is contractual. Anthropic's commercial terms say flat out that they may not train on your content. That's a bar in the contract, not a checkbox someone might tick wrong.

On free consumer tiers it's the opposite. Anthropic changed its consumer terms in August 2025: free and Pro accounts do get used for training when the setting is on, and leaving it on takes retention from 30 days to five years. Google's consumer terms say a subset of chats get read by human reviewers and kept for three years, and their own documentation says that happens even when activity history is switched off.

Same person. Same client file. Completely different outcome depending on which login they used.

Takeaway: The biggest exposure in most firms isn't the AI vendor. It's that nobody gave the team an approved account, so they're using their own.

This is the one worth spending time on, and it's where the phrase "private instance" causes trouble.

Nobody defines that phrase. No vendor uses it as a technical term. It's a sales word bundling four separate things people assume come together: whose contract you're under, whether they train on it, whether they keep a copy, and whether the network path is private. Any one can be true while the others aren't.

Here's the actual ladder.

Rung three is worth understanding, because the mechanism is genuinely clever. AWS doesn't call Anthropic when you send a prompt. They took a copy of Anthropic's software and put it in an account Anthropic cannot log into. AWS says it plainly:

Default posture is zero operator access and zero data retention. Nothing stored, and nobody at AWS can read it either.

One catch that's about three months old and almost nobody has noticed. AWS's newest Claude models won't run at all unless you opt into sharing your data with Anthropic. From AWS's own docs: those models require provider data sharing, and if you don't switch it on, they're simply unavailable to you. When you do, prompts and completions go to Anthropic and are kept 30 days for safety review, including possible human review.

Older Claude models are unaffected. But it means "the model maker never sees your Bedrock data" has gone from a platform guarantee to a per-model thing you have to check. AWS's marketing page still carries the old blanket version. The technical docs say otherwise.

Two things "private" does not mean. It doesn't mean your own copy of the model. Paying for dedicated capacity buys guaranteed speed, not isolation, and AWS describes it purely in tokens per minute. And it doesn't mean nothing is recorded. Every rung except the last logs something under some conditions.

Takeaway: The biggest store of prompts in most organisations is the logging they switched on themselves.

Now the fun part.

Firms will spend six weeks interrogating an AI vendor about data residency, then go back to work in a software stack they have never once checked. So I checked it.

Canva is the one that gets me. Australian company, founded in Sydney, and their trust centre says word for word: "Canva stores your data in the United States."

So the honest version isn't "everything is offshore." It's mixed. Which is the point. Nobody knows which is which, including the firms with the strongest opinions about it.

And here's the bit I find genuinely funny. Xero's own AI feature, JAX, names OpenAI among its subprocessors. So a firm that refuses to let AI near client data, on the grounds it might leave the country, is already sending that data to a US model provider through the accounting platform they've run for a decade. Xero's terms say it isn't retained or used for training, which is exactly the protection they're refusing to accept from anyone else.

Takeaway: Go and read your own vendors' hosting pages before you audit anyone else's.

I read the actual instruments, because I assumed there had to be a rule underneath all this.

There isn't. Australia has no data localisation law for private companies. The rules people cite are usually either government procurement conditions that don't apply to them, or accountability requirements that say "be responsible for it," not "keep it here."

The one thing that is real landed on 22 July. The Tax Practitioners Board's AI guidance. Putting client information into an AI tool is a disclosure to a third party, so you need the client's permission, ideally written into your engagement letter. The TPB wants you to tell clients where the disclosure goes and whether AI tools are involved.

That's a consent requirement, not a hosting requirement. And most engagement letters in Australia don't cover it.

Takeaway: If you're an accountant, fix the engagement letter. Not the servers.

Say you want it onshore anyway. Fair enough. Sometimes the board just wants it, and "we process your data in Australia" is a good line to have with clients.

There are exactly four routes that genuinely work. Here they are.

1. Claude through AWS Bedrock, Melbourne region. The only way to run a frontier model with real Australian residency. Costs about 10% over standard pricing. Not a multiple. Ten percent. Most people assume sovereignty is expensive and it isn't.

2. Microsoft 365 Copilot. Microsoft has processed Copilot prompts and responses inside Australia since late 2025, at no extra cost. If you're already on M365 you have this, and you probably didn't know.

3. An Australian provider. SCX listed on the ASX last week and is the only one publishing per-token prices, with an API close enough to a drop-in swap. ResetData has over a thousand H200s in Melbourne. Vault Cloud has the strongest certifications in the country.

4. Your own hardware. Open-weight models on servers you control, or through a GPU cloud like Fireworks. Nobody else is involved, and you inherit the GPUs, the patching and the evaluation.

The catch on options 3 and 4: both serve open-weight models only. GLM, Qwen, Llama, DeepSeek. Good models, not frontier models. You are trading capability for control, and that's a real trade, not a technicality.

What you cannot do, at any price: Anthropic direct has no Australian option and stores in the US. OpenAI will store your data in Australia but runs the actual inference in the US, Europe or the UAE. Google Workspace offers US or EU only. Storage residency and processing residency are different products, and the marketing rarely says so.

And one trap on option 1. AWS has a setting called the AU inference profile that used to mean Sydney and Melbourne. In March 2026 they quietly added Auckland to it. So the box your compliance person ticked now means Australia and New Zealand. If your commitment to clients is literally "the data does not leave Australia," that setting no longer says what you think it says. Pin to the Melbourne region instead.

Worth being honest about the ceiling on all of this, too. Hosting in Australia does not put your data beyond US reach, because the legal test is who controls it, not where it sits. Microsoft's own public affairs director was asked under oath by the French Senate whether he could guarantee French citizens' data would not be handed to the US government:

Takeaway: Your vendor's promise is to challenge an unfounded request. Not to refuse a valid one.

I used to tell people the enterprise contract handles it. Sign the agreement, you're covered, move on.

That's mostly right and incomplete in a specific way. Enterprise agreements don't buy zero retention. Every vendor keeps flagged content, and the windows are long. Anthropic holds flagged material up to two years.

The zero-retention products also have holes exactly where you'd assume they don't. Anthropic's excludes the Claude Team and Enterprise interfaces, so buying Claude Enterprise doesn't get you zero retention on Claude Enterprise. And the newest frontier models now require 30-day retention even for customers who specifically paid for zero.

None of that means don't sign it. It means read it.

Takeaway: Contract first, is it training on your data and can you point at the clause. Architecture second, who can technically see it and what's being logged. Geography third. It matters, it's cheaper than you think, and it's still the least important of the three.