Data Residency Attestation
RR Sols Pty Ltd t/a WattleAddr · ABN 56 672 722 486 · Last updated 4 September 2026
This attestation states where WattleAddr stores and processes data, who operates it, and which third parties are involved. It is written for procurement and security reviewers assessing whether WattleAddr meets Australian data-residency requirements. Issued by RR Sols Pty Ltd (ABN 56 672 722 486).
1. Scope of this attestation
This attestation describes how the Service operates as at 4 September 2026, the date its facts were last verified. It is a statement of current arrangements, not an open-ended undertaking that they will never change. If we change where data is stored or processed we will update this document; where the change involves adding or replacing a sub-processor, we will also give you notice and a right to object, as set out in our Data Processing Agreement. We re-issue it whenever a sub-processor, hosting location, ownership fact or standards claim changes. Ask us for a current copy before relying on it for a procurement decision.
2. Status of this document
This attestation is provided for information. It is not a warranty and does not form part of any contract unless an Order Form expressly incorporates a dated copy. Our liability in respect of it is governed by the Terms of Service. A signed copy on letterhead carries the same status as this page.
3. Who operates the service
WattleAddr is operated by RR Sols Pty Ltd (ABN 56 672 722 486), an Australian company incorporated and resident in Australia. It has no foreign parent, no foreign shareholder and no foreign entity anywhere in its ownership chain, and no overseas affiliate holds, or has access to, customer or end-user data. There is therefore no corporate group through which a foreign disclosure regime such as the US CLOUD Act could reach your data. Whether any foreign law might otherwise apply is a question for your own advisers; we make no representation about it.
4. Where data is stored and processed
All production infrastructure is located in Australia. The primary deployment is in Sydney, operated on Australian infrastructure provided by Binary Lane Pty Ltd, an Australian company. A standby deployment in Melbourne, also operated by Binary Lane on Australian infrastructure, serves the API if the Sydney site is unavailable. Backups are held in Australia.
The database holding customer accounts and the end-user search log is provided by WattleDB, a managed PostgreSQL platform that is another product of RR Sols Pty Ltd, running on Binary Lane infrastructure in Australia. It is the same legal entity, so no third-party sub-processor arises; we disclose it so a reviewer can assess it. A WattleDB incident would affect WattleAddr, and the SLA does not exclude it.
Address queries submitted to the API are processed in Australia and answered from Australia. There is no foreign CDN, no offshore edge, and no third-party analytics or error-reporting service in the request path.
An end user's keystrokes reach our Australian infrastructure directly and are answered from it. No foreign network under our control carries them.
5. Sub-processors and other services
The following third parties handle data on our behalf, and all handle it in Australia. Only our hosting provider handles end-user address data; the others see account-holder details only. One narrow exception applies outside the address request path: when you open the card-payment form in the developer console, your browser loads our payment processor's card-capture script from their content delivery network, which is operated globally. That request discloses your IP address and browser type only, no address data, no account data and no card data, and the processor's own systems are in Sydney.
| Provider | Purpose and what it sees | Location |
|---|---|---|
| Binary Lane Pty Ltd | Cloud hosting and infrastructure for the API, console and website; Sydney primary and Melbourne standby | Australia (Sydney and Melbourne) |
| Pinch Payments | Processing customer payments of WattleAddr invoices (one-off card payments). No end-user address data. | Australia (Sydney); in-browser card-capture script served from a global CDN |
| VentraIP Australia Pty Ltd | Outbound email: invoices, account and service notices, contact-form messages. Sees account-holder name, email address and invoice content. No end-user address data. | Australia |
Two services run outside Australia and carry no customer or end-user data: uptime probes run from GitHub-hosted servers and fetch only our public pages and API health endpoint; outage alerts to us are sent through Telegram and contain only status text. Shopify, for merchants who install our app, is the sales platform rather than our service provider; we send it plan selections and it sends us store domains and subscription status, never end-user address data.
We give at least 30 days' notice before adding a sub-processor, as set out in our Data Processing Agreement.
6. Source of the address data
Address records are derived from the Geocoded National Address File (G-NAF), published as open data by Geoscape Australia (Geocoded National Address File, open data source). G-NAF is an Australian national dataset. We ingest each quarterly release and serve it from our own Australian infrastructure; queries are not forwarded to Geoscape or any other party.
7. What we hold about end users
The service receives the address text an end user types and returns matching Australian addresses. Depending on your configuration we may retain a search log containing that query text and the matched address. Retention is set by you per workspace, search-log text is automatically purged once your configured retention period passes, and it is deleted at once when you delete the workspace.
We do not sell, share or use end-user address data for advertising, profiling or model training.
8. Access control
Access to production systems is limited to authorised personnel of RR Sols Pty Ltd located in Australia, over authenticated and encrypted channels. API keys are stored only as a prefix plus a cryptographic hash, never in plain text. Data is encrypted in transit.
9. Government access requests
As at 4 September 2026 we had not received a request from any government for customer or end-user data. If we receive one we will, unless legally prohibited, notify the affected customer before disclosing anything and will disclose only what we are legally compelled to disclose.
10. Standards posture
Our infrastructure is architected to align with Australian government expectations for data residency: all production data and processing is onshore, on infrastructure operated by Australian companies. We do not currently hold an IRAP assessment, ISO 27001 certification or equivalent third-party audit, and we do not claim one. As at 4 September 2026, neither we nor our hosting provider appears on the Hosting Certification Framework's list of certified providers.
We state this plainly so a reviewer does not have to infer it. If a formal assessment is required for your procurement, contact us and we will discuss what is achievable.
11. Verifying this attestation
Contact legal@wattleaddr.com.au for a signed copy on company letterhead, a completed security questionnaire, or to arrange a screen-shared walkthrough of our controls. Technical questions can go to support@wattleaddr.com.au.
This document is part of the agreement between you and RR Sols Pty Ltd. It is not advice about your own legal position; get your own advice if you need it. Questions: legal@wattleaddr.com.au.