PitlaneHQ data residency.
Your workshop's records are stored in Australia. Some things we rely on are not, and this page names them.
The short answer
Your workshop's records — every job, invoice, customer, vehicle, booking, photo and inspection — are stored in Australia. The databases and the file storage run in Microsoft Azure's Australia East region in Sydney. Backups stay in Australia too, with one exception we name below. Image recognition, text embeddings, job estimation and summaries of recorded Pitlane Phones calls are processed in Australia. Ask the Boss, and the other AI features that generate or analyse text, may be processed outside Australia (see below). So are calls answered by the AI receptionist: ElevenLabs handles them in the United States, and we then store the recording, transcript and summary in Australia.
That is not the same as saying nothing ever leaves the country, and we are not going to say that. Sending an SMS means giving a mobile number to an SMS carrier. Sending an email means giving an address to an email provider. Keeping a disaster-recovery copy with a second, independent company means that copy sits wherever that company operates. Every one of those is listed further down, by name, with what it receives.
We looked for a page like this from other Australian workshop-software vendors in September 2026 and could not find one. If we missed yours, tell us and we will link to it. If you are comparing us with someone else, this is a fair question to ask them too.
What is in Australia
Australia East is Microsoft's Sydney region. Australia Southeast is its Melbourne region. Where a second Australian region appears below, it is because Azure keeps a replica copy in the paired region so a single data-centre failure does not lose your data — that pairing is Sydney to Melbourne, so the copy is also in Australia. The AI rows below describe direct AWS Bedrock processing in our own AWS account in Australia. Ask the Boss, and the other AI features that generate or analyse text, may instead use OpenRouter outside Australia, as described below.
| What | Where it runs |
|---|---|
| Main production database — jobs, invoices, customers, vehicles and bookings | Azure Australia East (Sydney) |
| Second database used by assistant and search features | Azure Australia East (Sydney) |
| Vehicle data database | Azure Australia East (Sydney) |
| File and photo storage — job photos, inspection photos and video, uploaded documents | Azure Australia East (Sydney) |
| Replica copy of that file storage | Azure Australia Southeast (Melbourne) |
| Database point-in-time backups | Azure Australia East, 7-day window |
| Database geo-redundant backups | Azure Australia Southeast (Melbourne) |
| Cache, secret store and application logs | Azure Australia East (Sydney) |
| Daily off-site encrypted backup, copy 1 | Amazon Web Services, Sydney (ap-southeast-2) |
| AI features — job estimation, summaries of recorded Pitlane Phones calls, image recognition, and the answers we suggest for the AI receptionist from past calls and texts; and the other AI features that generate or analyse text, such as message and quote drafting, unless we route them through OpenRouter (see What leaves Australia). Calls answered by the AI receptionist are processed by ElevenLabs (see What leaves Australia) | Amazon Bedrock, Sydney (ap-southeast-2), using Australian-only inference profiles |
| Text embeddings for search | Amazon Bedrock, Sydney (ap-southeast-2) |
| Voice-to-text for in-product dictation. Transcription of recorded Pitlane Phones calls runs on the same Australian service, but Pitlane Phones is not yet available. Calls answered by the AI receptionist are transcribed by ElevenLabs instead (see What leaves Australia). | Azure Speech, Australia East |
| Rego and vehicle lookups | InfoAgent / NEVDIS, Australia |
| ABN lookups | Australian Business Register, Australia |
| Parts ordering | Bapcor / Burson, Australia |
One footnote for anyone who audits this properly. If you list our cloud resources you will see a handful reported at "global" scope rather than in a region. Those are monitoring alert rules — the definitions that tell us when something breaks. They hold no customer data.
Ask the Boss
Ask the Boss uses direct AWS Bedrock processing in our own AWS account in Australia unless OpenRouter is configured. When configured, OpenRouter may route Ask the Boss to Amazon Bedrock outside Australia. OpenRouter has no Australian endpoint. Each request asks OpenRouter to route only to zero-data-retention providers that do not collect the data. Other direct AWS Bedrock processing in our own AWS account stays in Australia.
Depending on the features used and the user's permissions, Ask the Boss can receive questions and conversation text; customer names; staff and technician names and hours worked; vehicle details, including registration numbers (rego), VINs and specifications; job numbers, status, descriptions, notes and repair history; quote and invoice descriptions, draft line items and prices; booking details; stock names, SKUs, quantities, reorder levels and locations; catalogue names and prices; and manufacturer technical data.
Other AI features that generate or analyse text
The other AI features that generate or analyse text, such as SMS and review-reply drafts, quote and invoice wording, technician-note cleanup, website chat replies, inspection classification, reporting summaries, and import and upsell suggestions, use direct AWS Bedrock processing in our own AWS account in Australia until we switch them to OpenRouter. Once switched, each request asks OpenRouter to route it only to Amazon Bedrock, outside Australia. When we last checked, on 26 October 2026, those endpoints were in the United States and Europe, or global endpoints that can process a request in other countries; OpenRouter has no Australian endpoint. Each request asks OpenRouter to route only to zero-data-retention providers that do not collect the data. When OpenRouter is unavailable, a request can fall back to our own AWS account in Australia. Image recognition, text embeddings, job estimation, and call summaries and follow-ups are not routed through OpenRouter.
MechanicDesk import record matching, which matches imported staff, booking links and customers to existing records, is different: it uses OpenRouter whenever OpenRouter is configured, whether or not we have switched the features above, and falls back to our own AWS account in Australia when OpenRouter is unavailable. Its requests ask OpenRouter to route only to Amazon Bedrock and only to providers that do not collect the data, but do not ask for zero data retention.
AI receptionist calls
Where a workshop turns the AI receptionist on for a site, calls to that site's texts number can be answered by an AI agent run by ElevenLabs in the United States, outside Australia. ElevenLabs turns the caller's speech into text, runs the conversation on an Anthropic Claude model accessed through ElevenLabs, speaks the replies, and writes the transcript and summary. It receives the caller's and called numbers, the call audio, everything said on the call, and what the agent looks up to answer it, such as free booking times and answers the workshop has approved. After the call it sends us the recording, transcript and summary, and we store them in Australia. Each agent is set to have ElevenLabs keep the call for 30 days. If the caller objects to the recording, we delete the audio we hold and ask ElevenLabs to delete the call sooner. Twilio, in the United States, carries the call to ElevenLabs. When neither a person nor the AI can take a call, Twilio records a voicemail; we copy it to storage in Australia and ask Twilio to delete its copy.
The answers we suggest to a workshop from its past calls and texts are worked out on direct AWS Bedrock in our own AWS account in Sydney, not by ElevenLabs. Once staff approve an answer, it reaches ElevenLabs whenever the AI receptionist's knowledge search returns it during a call, whether or not it is read out.
What leaves Australia
These are the providers that hold or process some part of your data outside Australia. We would rather publish this than have you find it yourself. Our sub-processor register is the fuller record and we update it as we become aware of changes. Treat this table as the summary; if the two ever disagree, tell us and we will correct both.
| Provider | Where | What it receives |
|---|---|---|
| Backblaze B2 | Outside Australia — Backblaze operates no Australian region (its regions are US East, US West, EU Central and Canada East) | A second daily copy of the same encrypted backup bundle: all three databases plus file storage |
| Sentry | Germany (Sentry's EU region) | Error and performance reports. These can include the signed-in user's name, email address and internal account identifiers |
| OpenRouter | Outside Australia: for the AI text features, the United States, Ireland or global endpoints that can process a request in other countries, when we last checked on 26 October 2026. OpenRouter has no Australian endpoint | Ask the Boss requests, where Ask the Boss is configured to use it, and the content sent to the other AI features that generate or analyse text, once we switch them to it; each of those requests asks OpenRouter to route only to zero-data-retention providers that do not collect the data. Wherever OpenRouter is configured, also the staff, booking and customer records matched during a MechanicDesk import; those requests ask only for providers that do not collect the data |
| Twilio | United States | Mobile numbers and SMS message content, and the numbers and times of voice calls to a site’s texts number. Where a workshop turns on call forwarding or the AI receptionist, also the audio of those calls as Twilio carries them. Where a workshop has the AI receptionist, also the voicemails Twilio records when neither a person nor the AI can take a call, until we have copied each one to Australia and Twilio has deleted it at our request |
| ElevenLabs | United States | Calls answered by the AI receptionist, where a workshop turns it on: the caller’s and called numbers, the call audio, everything said on the call, and what the agent looks up to answer it. ElevenLabs produces the transcript and summary there. Each workshop’s agent is set to have ElevenLabs keep the call audio and transcript for 30 days. We store the recording, transcript and summary in Australia. If the caller objects to the recording, we ask ElevenLabs to delete the call sooner and delete the audio we hold |
| Resend | United States | Email addresses and email content |
| Stripe | Australia and United States | Billing contact, payment method and transaction history for the workshop's own PitlaneHQ subscription |
| Cloudflare | Global edge network | Request metadata and IP addresses |
| Mapbox | United States | Partial addresses typed into address lookup |
| OpenStreetMap (Nominatim) | Europe | A workshop's own business address, when that workshop opts into the marketplace listing |
| Vehicle Visuals | United States | Vehicle identifiers used to fetch vehicle imagery |
| Xero | Australia and New Zealand | Invoice, payment and customer records, only where a workshop connects Xero |
| Intuit (QuickBooks Online) | United States | Invoice and customer records, only where a workshop connects QuickBooks |
| Advertising platforms (Google, Meta, Microsoft, LinkedIn, TikTok) | United States and elsewhere | Conversion events. For a workshop's customers, only where that workshop connects its own advertising accounts. We separately report enquiries and signups from our own website to our own advertising accounts. |
One thing you will not find in that table. Our address lookup used to run on Google Places and now runs on Mapbox, and the old Google key is still sitting in our configuration unused. We have left it off the list because nothing in the product calls it any more, so no customer data goes there — but if you audit our configuration you will see it, and we would rather explain it here than have you wonder.
Each of these is engaged under written terms intended to address Australian Privacy Principle 8; our Data Processing Addendum sets out how we handle that, and you can ask us about a specific provider. Our sub-processor register lists every provider we use, including the ones that do stay in Australia, and our Privacy Policy explains the legal basis for each disclosure.
Backups, and the one copy that is not in Australia
There are four separate backup copies of your data, and three of them are in Australia. The live system in Sydney and its Melbourne file-storage replica are on top of those.
The live databases run in Sydney. Azure keeps continuous point-in-time backups with a seven-day recovery window, and replicates those backups to its paired Australian region in Melbourne. Separately, once a day, we take a full export of all three databases and the file storage, encrypt it, and upload it to two different companies so that a bad day at any one provider cannot take the backups with it. The first of those goes to Amazon Web Services in Sydney.
The second goes to Backblaze, and Backblaze has no Australian region. That copy is held overseas. It is encrypted with AES-256 before it leaves our systems, and the passphrase needed to read it is held in our own key vault and a separate secret store — never with Backblaze — so what they hold is a file they cannot open. We keep it because a second, independent provider is what makes the backups survive a failure at the first one — but it is a copy of your data outside Australia, and it would be dishonest to write a page like this and leave it out.
We have not published which of Backblaze's regions holds that copy. Backblaze operates in the United States, the Netherlands and Canada, and we would rather say that plainly than name a region we have not confirmed.
If your organisation cannot accept an encrypted off-site copy held outside Australia, tell us before you sign up. That is a reasonable requirement for some fleet and government buyers and we would rather know.
What we do not have
Being straight about the gaps is the only way the rest of this page is worth anything.
- No security certification. We are not ISO 27001 certified. We are not SOC 2 audited. We have not been through an IRAP assessment. We have no certification of any kind, and we are not going to imply one by listing the controls we happen to have implemented as though they were an audit result.
- No high availability on the database. Our three production databases each run as a single server with high availability switched off, and there is no standby to fail over to. If one fails, restoring from backup takes time. We publish our current recovery position rather than implying a guarantee we cannot meet.
- No independent penetration test. We have not had one carried out.
- Our sub-processor list is maintained on a best-efforts basis. We update it when we become aware of a change. We do not claim it is guaranteed complete, and we correct it when we find something missing — including as part of publishing this page.
What is planned
These are not done, and none of them has a date. They are listed so you can tell the difference between what we have built and what we intend to build.
- Moving the second off-site backup copy to a provider with an Australian region is something we want to do. It is not done and we have not committed to a date.
- Database high availability requires a larger database tier than we run today. We have not scheduled it.
- We have no certification programme under way. If we start one, we will say so here rather than describing it in advance.
Checking this yourself
If you are evaluating PitlaneHQ for a fleet, a dealership group or a government contract, ask us for specifics and we will answer them. Email privacy@pitlanehq.com.au. If anything on this page turns out to be wrong, tell us and we will correct it here.
Last updated: 2 November 2026