AmmaCloud · Sovereign Architecture

Sovereign by default.
Australian by architecture.

Your customer data never leaves the country. Your control never leaves your hands. AmmaCloud is our sovereign Australian inference stack — four layers built so your business meets its obligations without compromise.
Book a first meeting → See the four layers
AU-HOSTED · NO FOREIGN PROVIDERS · PRIVACY ACT 1988 · APRA CPS 234 · ISO 27001
[ i ] The Principle

You don't run the platform. We do.

The safest AI deployment is the one you never have to secure yourself. We don't hand you a system to harden, patch, and audit — we run it on AmmaCloud and own the result. The platform's risk never reaches you, because you never touch the platform.
Sovereignty isn't a security feature we sell you later. It's the architecture, before you ever sign — inbound, governance, inference, residency, each designed so onshore stays onshore and control stays yours.
[ ii ] The Architecture

Four layers. One sovereign stack.

Every layer of AmmaCloud is designed so Australian businesses meet Privacy Act 1988, APRA CPS 234, and ISO 27001 obligations without compromise. No foreign provider touches your customer data. Local by default.
L · 01

Inbound

Where customer data first touches our infrastructure.
  • · TLS 1.3 on every channel
  • · Australian-only ingress endpoints
  • · DDoS and abuse filtering before processing
  • · No data written to disk in transit
AU-EAST INGRESS · TLS 1.3
L · 02

Governance

Rules that decide what AI can see, do, and remember.
  • · Role-based access on every workflow
  • · Per-tenant prompt and tool whitelisting
  • · Human approval gates on sensitive actions
  • · Full audit trail, exportable on request
PRIVACY ACT 1988 · APRA CPS 234
L · 03

Inference

Where the AI work happens.
  • · Foundation models, governed and monitored
  • · No customer data used for model training
  • · No foreign provider in the data path
  • · Output validation before any action is taken
NO TRAINING · NO RETENTION
L · 04

Residency

Where data lives, who can reach it, how long it stays.
  • · Australian-hosted storage by default
  • · Customer-defined retention windows
  • · Right-to-deletion enforced end-to-end
  • · Encryption at rest and in transit
ISO 27001 · AU SOVEREIGN
[ iii ] Compliance

Mapped to the obligations you actually carry.

Not a badge wall — a mapping. Here is what each obligation requires, and how the architecture meets it.
Privacy Act 1988

Australian Privacy Principles

  • · Collection, use, and disclosure controlled per workflow
  • · Access and correction rights supported
  • · Cross-border disclosure avoided by design
APP 1–13 ALIGNED
Notifiable Data Breaches

Breach readiness

  • · Audit logging on every data touch
  • · Anomaly alerting and containment playbooks
  • · Assessment and notification support if required
NDB SCHEME READY
APRA CPS 234

Information security

  • · Defined roles and responsibilities
  • · Controls tested, not just documented
  • · Incident response and reporting hooks
REGULATED-INDUSTRY FIT
ISO 27001

Information security management

  • · Risk-based control selection
  • · Access management and segregation
  • · Continuous monitoring and review
ISMS-ALIGNED CONTROLS
ACSC Essential Eight

Baseline hardening

  • · Patched and version-managed infrastructure
  • · Least-privilege and MFA on admin access
  • · Backups and recovery tested
HARDENED BY DEFAULT
Data Residency

Onshore, end to end

  • · Ingress, inference, and storage in Australia
  • · No customer data leaves the country
  • · Residency you can put in front of a regulator
AU SOVEREIGN
[ iv ] The Alternatives

Three ways to run AI. One keeps the risk off your desk.

Powerful AI is easy to switch on and hard to run safely. The difference between the options below is not capability — it is who carries the exposure after go-live.
Option A

Foreign SaaS AI

Fast to start, but your data leaves the country. Residency, retention, and training terms are the vendor's to set — not yours. Hard to put in front of an Australian regulator.

Option B

DIY / self-hosted platform

Flexible and yours — but you inherit the hardening, the patching, the exposed-instance headlines, and the audit findings. Most deployments stall the moment security and IT get involved.

Ammacatize

AmmaCloud — sovereign & managed

Australian-hosted and run by us. We harden it, patch it, monitor it, and own the result. You never operate a platform, so you never inherit its risk. You get the outcome, on the record, onshore.

[ v ] Questions

Sovereignty, answered plainly.

Where is my data hosted? +

In Australia, by default. AmmaCloud runs on Australian-hosted infrastructure with Australian-only ingress. Your customer data is stored and processed onshore, with residency you can put in front of a regulator.

Do you send my data to foreign AI providers? +

No foreign provider touches your customer data as a matter of architecture — not policy you have to trust. Inference is governed and monitored within the sovereign stack, and nothing in the data path sits offshore.

Do you train AI models on my data? +

No. Your data is never used to train models. Retention is limited to what you define, and inference does not learn from your content.

Are you Privacy Act 1988 compliant? +

AmmaCloud is built to meet Privacy Act 1988 obligations — including the Australian Privacy Principles and the Notifiable Data Breaches scheme — alongside APRA CPS 234 and ISO 27001 controls. Governance, access control, and audit logging are part of the architecture, not an add-on.

Can I get an audit trail of what the AI did? +

Yes. Every data touch and every action is logged and exportable on request, so you can show a board or a regulator exactly what happened, when, and under whose authority.

Do I have to manage or secure any of this myself? +

No — that is the whole point of a managed service. We run AmmaCloud, harden it, patch it, and monitor it. You never operate a platform, so you never inherit a platform's risk. You get the outcome; we carry the operational responsibility.

[ vi ] Next Step

Sovereignty you can put in front of your board.

30 minutes. No pitch. We walk your obligations, then show you exactly how the architecture meets them.
Book a first meeting → Back to home