The Four Levels of AI Data Security for Australian Business

AI data security for an Australian business comes down to where your data actually goes, and there are four practical levels of protection. From least to most secure: a public chatbot that trains on what you type, a provider that contractually will not train on your inputs, a cloud instance hosted inside Australia, and a model running entirely on hardware you own. Each level keeps the data closer to home. The level you are on decides whether an AI tool is a productivity gain or a reportable breach, and most businesses have never checked.

I understand why it goes unchecked. The convenience is immediate and the exposure is invisible. Australia’s privacy regulator received 532 data breach notifications in the January to June 2025 reporting period (OAIC), and a firm pasting client details into a chatbot adds to that exposure without a single line in the budget to show for it. For a law firm, an accountant or a medical practice, the distance between level one and level four is the distance between a useful tool and a phone call to the OAIC.

Here is the ladder at a glance. The examples are current products; the levels are the thing to remember.

Level	Typical example	Trains on your inputs	Where the data is processed	Who it suits
1. Public chatbot	ChatGPT Free, Claude Free	Can be, depending on your settings	Overseas, on the provider’s servers	Nothing confidential
2. Commercial terms	OpenAI API, Anthropic API, Claude for Work	No, by contract	Overseas by default	Public copy, internal drafting
3. Australian cloud region	Amazon Bedrock in Sydney, Microsoft Copilot Studio in Australia East, Google Cloud in Sydney	No, by contract	Inside Australia, on rented infrastructure	Client records under APP 8
4. Local model	Ollama running Llama or Qwen on your own workstation	No, there is no provider	Inside your building, on hardware you own	Privileged, health and financial records

Level one: a public chatbot that trains on what you type

Level one is a consumer AI account, such as ChatGPT Free or Claude Free, where your conversations can be used to train the model unless you find the setting that turns it off. It is the least secure of the four levels, and it is where most staff start, because it is free and needs no approval from anyone.

Consumer plans treat your data differently from business agreements. Anthropic states that for its consumer products such as Claude Free, Pro and Max, “We will use your chats and coding sessions (including to improve our models) if” you allow it in your settings (Anthropic Privacy Center). The same page notes that “Your Incognito chats are not used to improve Claude”, which is a useful setting to know about and a poor foundation for a firm’s data policy, because it depends on every staff member remembering to use it.

The regulator’s position on this level is plain, and I’d put it in front of any team before the first paste:

“As a matter of best practice, the OAIC recommends that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools”

Office of the Australian Information Commissioner, Guidance on privacy and the use of commercially available AI products (OAIC)

The exposure here is twofold. Your confidential text may be retained and used to improve a system millions of strangers query, and it sits on overseas servers governed by someone else’s terms. For regulated work this is the level that quietly creates problems, because the person typing usually believes the tool is private when the default settings say otherwise.

Level two: a provider that contractually won’t train on your data

Level two is a business or API tier where the provider contractually commits not to train on your inputs. That is a real improvement, but your data still leaves the country. OpenAI states that “As of March 1, 2023, data sent to the OpenAI API is not used to train or improve OpenAI models” unless you opt in (OpenAI). Anthropic gives the same assurance for its commercial products.

“By default, we will not use your inputs or outputs from our commercial products (e.g. Claude for Work, Anthropic API, Claude Gov, etc.) to train our models.”

Anthropic Privacy Center, commercial customers (Anthropic)

This closes the training risk, but not the location one. Under Australian Privacy Principle 8, an entity that discloses personal information to an overseas recipient “is accountable for any acts or practices of the overseas recipient in relation to the information that would breach the APPs” (OAIC). The liability follows the data offshore, even when you have done the paperwork. The Privacy Act binds Australian Government agencies and organisations with an annual turnover of more than $3 million, and some other organisations (OAIC). Regardless of turnover, the Privacy Act covers any business that is a health service provider (OAIC), so a small clinic is inside the Act at any size.

The providers know the location question is coming. OpenAI’s data-residency table now lists an Australian endpoint, au.api.openai.com, for storing data in the country, while processing was listed as not available for Australia when I checked, and the page states that “Data residency endpoints are charged a 10% uplift for models released on or after March 5, 2026” (OpenAI). So, my honest reading: level two is getting better, and it is still a contract with an overseas company about where an overseas company keeps your data.

Level three: a cloud AI instance hosted in Australia

Level three keeps the data in Australia by running the model inside a cloud region physically located here, so your prompts and documents never cross a border. All three major clouds now offer an Australian region.

Amazon Bedrock is available in the Asia Pacific (Sydney) ap-southeast-2 region (AWS), Google Cloud lists Sydney (australia-southeast1) among the locations for its Gemini and Claude models (Google Cloud), and Microsoft’s Copilot Studio lists Australia East (New South Wales), Australia Southeast (Victoria) among its data locations (Microsoft).

The commercial terms at this level keep your inputs out of model training as well. Microsoft states that your prompts and completions “are NOT used to train any generative AI foundation models without your permission or instruction” (Microsoft), and AWS explains that the model providers behind Amazon Bedrock “don’t have access to Amazon Bedrock logs or to customer prompts and completions” (AWS). You get a managed, capable model with the cross-border question answered.

Two details decide whether it actually stays here. Microsoft notes that “Prompts and responses are processed within the customer-specified geography” only when you are not using a Global or DataZone deployment type, so the deployment type your developer picks matters. And Copilot Studio’s data-location page says that “If a tenant’s location isn’t listed in the data locations table, data is stored in the United States”. Residency is a property of how your account was set up, not of the product you bought, and I ask for it in writing before a build starts.

For many Australian businesses this is a sound, pragmatic choice. The trade-off is that the model still runs on infrastructure you rent rather than own, governed by a provider’s account model and shared-responsibility terms. It resolves the cross-border problem, but the data still lives in a third party’s environment, which for the most sensitive work is one boundary too many.

Level four: a local AI that never leaves the building

Level four is a private model running on hardware you control, where confidential data never leaves your premises at all. This is the Fortress approach. There is no provider account and no overseas region: the model, the documents it reads and the answers it returns all stay inside your own walls.

Open-weight models such as Meta’s Llama and Alibaba’s Qwen run through free software such as Ollama on a single workstation, and the model still works with the network cable pulled out. For a firm whose entire obligation is keeping client information confidential, this is the only level that removes the exposure rather than contracting around it.

The objection used to be capability, and that objection has weakened faster than I expected. Stanford’s AI Index tracked the gap between open and closed models over a single year:

“Open-weight models are also closing the gap with closed models, reducing the performance difference from 8% to just 1.7% on some benchmarks in a single year.”

Stanford HAI, The 2025 AI Index Report (Stanford)

The same report found that “the inference cost for a system performing at the level of GPT-3.5 dropped over 280-fold between November 2022 and October 2024”, which is a large part of why a capable model now fits on a single workstation rather than a data centre. The sizes and the software, hardware included, are in how to run AI models on your own computer, and what it takes to run a private AI agent covers the step from a chat window to a system staff can rely on. Paired with retrieval over your own files, you get the working power of a modern assistant with the data discipline of an offline archive. This is the level our private AI builds are designed around, because for confidentiality-sensitive industries the safest place for the data is the only place that counts. And the honest qualifier: if level three already covers your obligation, that is what I’ll tell you.

Which level does your business actually need?

The right level is the lowest one that fully covers your obligation, and for confidentiality-bound work that is usually a level higher than the first guess. The OAIC’s figures for the first half of 2025 make the stakes concrete.

Malicious or criminal attacks remained the largest source of breaches, at 308 notifications, and the average number of individuals affected by cyber incidents is just over 10,000 (OAIC). The health sector had the most reported data breaches, at 18 per cent, and the OAIC notes that “IBM calculates that in 2024 the average cost to business of a data breach was $4.26 million”. We track these indicators in our source-verified index of Australian AI and digital data.

The number that matters for the AI question is human error. It caused 193 notifications in the same period, 37 per cent of the total and up from 29 per cent in the previous six months. A staff member pasting a client file into a public chatbot is human error in exactly that sense, and it is the level-one failure the whole ladder exists to prevent.

A marketing team drafting public copy is fine at level two. A clinic, a law firm or an accountant handling privileged client records belongs at level three or four, where the data either stays in the country or never leaves the building. The levels are a hierarchy of where your data lives rather than of quality, and the correct answer is set by your duty of confidentiality, not by which tool is easiest to open. Choose the level deliberately, and the controls compound: data discipline, compliance and client trust reinforce one another instead of working against the convenience.

If you are not sure which level your current setup sits on, that is the first thing worth establishing. We can map where your data goes today and what it would take to move up a level. You can start a conversation or see how we scope a build.

Frequently asked questions

Is it safe to put confidential client data into ChatGPT or Claude?

Not on a consumer plan by default. Consumer tiers may use your conversations to improve the underlying models unless you change the setting, and the data sits on overseas servers. The OAIC recommends that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools. For confidentiality-bound work (law, medicine, accounting), the safe options are a commercial agreement that contractually excludes training, an AI instance hosted inside Australia, or a private model running on hardware you control.

What is data sovereignty and why does it matter for AI?

Data sovereignty means your data is subject to the laws of the country it physically sits in. It matters for AI because most public tools process your inputs on overseas servers. Under Australian Privacy Principle 8, an entity that sends personal information overseas remains accountable for how the overseas recipient handles it, so the legal responsibility does not stop at the border even when the data does.

What is a local or private LLM?

A local LLM is a language model that runs entirely on hardware you own or control, rather than on a provider’s cloud. Your prompts, your documents and the model’s answers never leave your premises, which removes both the training risk and the cross-border disclosure risk. Open-weight models such as Llama and Qwen run through free software such as Ollama on a single workstation GPU, making a private deployment practical for small businesses, not only large enterprises.

Does a cloud AI hosted in Australia solve the confidentiality problem?

It solves the data residency problem, which is a major part of it. Amazon Bedrock, Google Cloud and Microsoft all offer Sydney or Australia East regions, and their commercial terms keep your inputs out of model training. The remaining trade-off is that the data still lives in a third party’s infrastructure under shared-responsibility terms, and residency depends on how your tenant or deployment was configured. For the most sensitive work, a fully local deployment is the only option that keeps the data entirely in your control.