Where is your data room data actually stored?

Most providers will tell you where your documents are stored. Very few will tell you, without being asked twice, where those documents are processed. Those are different questions, and in a transaction the second one is the one that matters.

Storage location versus processing location

Storage is where the file sits at rest. Processing is every other system that touches it: the support desk that opens a ticket, the AI service that reads a document to answer a question, the email provider that sends a notification carrying the file name, the monitoring vendor whose logs record who opened what, and the backup infrastructure that may replicate to a second region.

A provider can answer yes to Australian storage while four or five of those sit offshore.

Why this lands on counsel

Australian Privacy Principle 8 governs cross-border disclosure of personal information. Before you disclose personal information to an overseas recipient you must take reasonable steps to ensure that recipient does not breach the Australian Privacy Principles, and under section 16C you generally remain accountable for their acts as if they were your own.

A data room is full of personal information: employee records, customer lists, contact details in contracts, board papers naming individuals. So the question "where is this processed" is not an IT question. It is a compliance position the seller has to hold for the whole life of the room.

The questions that expose it

• List every sub-processor, its function, and its country.
• Where is your support team physically located, and can it access document content?
• Where does AI inference run, and is document text sent to a third-party model provider?
• Where are backups stored, and is data replicated to another region?
• Where do your email, monitoring and analytics vendors sit?
• Is Australian residency standard, or an enterprise-only option?

Ask for written answers. Keep them with your vendor review. If a provider answers the first question with a region name rather than a list, ask again.

What good looks like

A provider that will hand you the sub-processor list with locations, unprompted, and where the list is short and every entry is domestic. Linkro stores all customer data in Australian data centres and every sub-processor is Australian, including support, AI inference, email and monitoring. That is standard on every plan, not an enterprise upsell.

What to do if you are already in an offshore room

Do not switch mid-process. Finish the deal, export the audit trail, and put the residency questions at the top of the list next time. If personal information has already crossed a border, tell your privacy adviser now rather than at completion, when the disclosure schedule is being finalised.