AmmaCloud · Architecture

Australian by architecture.
Processing on your terms.

Your control never leaves your hands. AmmaCloud is our own Australian inference stack. Where your data is processed is your choice, agreed before we start: entirely in Australia on AmmaCloud, or with approved international providers, with any countries or providers you exclude left out.
Book a first meeting → See the four layers
AU-HOSTED · AUSTRALIAN-ONLY PROCESSING AVAILABLE · PRIVACY ACT 1988
[ i ] The Principle

You don't run the platform. We do.

The safest AI deployment is the one you never have to secure yourself. We don't hand you a system to harden, patch, and audit — we run it on AmmaCloud and own the result. The platform's risk never reaches you, because you never touch the platform.
Sovereignty isn't a security feature we sell you later. It's the architecture, agreed before you sign — inbound, governance, inference, residency, each layer written so your choice of processing location holds and control stays yours.
[ ii ] The Architecture

Four layers. The stack you choose.

Every layer of AmmaCloud is designed so Australian businesses meet their Privacy Act 1988 obligations. Where your data is processed is your choice, agreed before we start and written into your service: entirely in Australia on our own inference stack, or with approved international providers, with any countries or providers you exclude left out. Models we run on our own Australian infrastructure send nothing offshore, whoever originally published them.
L · 01

Inbound

Where customer data first touches our infrastructure.
  • · TLS 1.3 on every channel
  • · Australian-only ingress endpoints
  • · DDoS and abuse filtering before processing
  • · No data written to disk in transit
AU-EAST INGRESS · TLS 1.3
L · 02

Governance

Rules that decide what AI can see, do, and remember.
  • · Role-based access on every workflow
  • · Per-tenant prompt and tool whitelisting
  • · Human approval gates on sensitive actions
  • · Full audit trail, exportable on request
PRIVACY ACT 1988 · AUSTRALIAN PRIVACY PRINCIPLES
L · 03

Inference

Where the AI work happens.
  • · Foundation models, governed and monitored
  • · No customer data used for model training
  • · Australian-only processing when you choose it
  • · Output validation before any action is taken
NO TRAINING · NO RETENTION
L · 04

Residency

Where data lives, who can reach it, how long it stays.
  • · Australian-hosted storage
  • · Customer-defined retention windows
  • · Right-to-deletion enforced end-to-end
  • · Encryption at rest and in transit
AU HOSTED · YOUR CHOICE OF PROCESSING
[ iii ] Compliance

Mapped to the obligations you actually carry.

Not a badge wall — a mapping. Here is what each obligation requires, and how the architecture meets it.
Privacy Act 1988

Australian Privacy Principles

  • · Collection, use, and disclosure controlled per workflow
  • · Access and correction rights supported
  • · Cross-border disclosure only where you have agreed it
APP 1–13 ALIGNED
Notifiable Data Breaches

Breach readiness

  • · Audit logging on every data touch
  • · Anomaly alerting and containment playbooks
  • · Assessment and notification support if required
NDB SCHEME READY
ACSC Essential Eight

Baseline hardening

  • · Patched and version-managed infrastructure
  • · Least-privilege and MFA on admin access
  • · Backups and recovery tested
HARDENED BY DEFAULT
Data Residency

Onshore when you choose it

  • · Ingress, inference, and storage in Australia under Australian-only processing
  • · Any overseas processing named and agreed in writing
  • · Residency you can put in front of a regulator
AU HOSTED · YOUR CHOICE
[ iv ] The Alternatives

Three ways to run AI. One keeps the risk off your desk.

Powerful AI is easy to switch on and hard to run safely. The difference between the options below is not capability — it is who carries the exposure after go-live.
Option A

Foreign SaaS AI

Fast to start, but residency, retention, and training terms are the vendor's to set — not yours, and your data goes wherever they run. Hard to put in front of an Australian regulator.

Option B

DIY / self-hosted platform

Flexible and yours — but you inherit the hardening, the patching, the exposed-instance headlines, and the audit findings. Most deployments stall the moment security and IT get involved.

Ammacatize

AmmaCloud — managed, on your terms

Australian-hosted and run by us. We harden it, patch it, monitor it, and own the result. You choose where processing happens and we write it into the service. You never operate a platform, so you never inherit its risk.

[ v ] Questions

Sovereignty, answered plainly.

Where is my data hosted? +

AmmaCloud runs on Australian-hosted infrastructure. If you choose Australian-only processing, your customer data is stored and processed onshore, with residency you can put in front of a regulator. If you choose approved international providers, we name them in your service so you know exactly where your data goes.

Do you send my data to foreign AI providers? +

Only if you choose it. Where your data is processed is your choice, agreed before we start and written into your service: entirely in Australia on our own inference stack, or with approved international providers, with any countries or providers you exclude left out. Models we run on our own Australian infrastructure send nothing offshore, whoever originally published them.

Do you train AI models on my data? +

No. Your data is never used to train models. Retention is limited to what you define, and inference does not learn from your content.

Are you Privacy Act 1988 compliant? +

AmmaCloud is built to meet Privacy Act 1988 obligations — including the Australian Privacy Principles and the Notifiable Data Breaches scheme — with controls aligned to the ACSC Essential Eight. Governance, access control, and audit logging are part of the architecture, not an add-on.

Can I get an audit trail of what the AI did? +

Yes. Every data touch and every action is logged and exportable on request, so you can show a board or a regulator exactly what happened, when, and under whose authority.

Do I have to manage or secure any of this myself? +

No — that is the whole point of a managed service. We run AmmaCloud, harden it, patch it, and monitor it. You never operate a platform, so you never inherit a platform's risk. You get the outcome; we carry the operational responsibility.

[ vi ] Next Step

Sovereignty you can put in front of your board.

30 minutes. No pitch. We walk your obligations, then show you exactly how the architecture meets them.
Book a first meeting → Back to home