URGENT - Hi @User Support Team, I am reaching out on behalf of Axia Health Technologies, where we are developing a clinically aligned AI Nursesolution designed for aged care, disability support (NDIS), and community health environments in Australia. The product will interface with sensitive health information, including identifiable client data, family details, care plans, clinical notes, and real-time voice interactions. Because we operate in a highly regulated healthcare setting, our system must strictly comply with Australian legal and professional requirements, including: Given these obligations and the nature of our service, we need to clarify your data handling capabilities before we integrate Vapi as the voice infrastructure layer for our AI Nurse. Specifically, could you please confirm the following: Does Vapi offer hosting or data processing on servers located within Australia? Can you confirm whether Vapi stores any call audio, text transcripts, metadata, or analytics by default? If so, we need details on: Exactly what is stored For how long Where it is stored Whether we can disable or control storage How deletion/retention policies are managed What compliance frameworks does Vapi currently support? If Australian data residency is possible, can you share documentation on your controls to ensure: No cross-border data transfer Enforced regional isolation Encryption standards for data in transit and at rest Access controls and audit logging Context on Why This Matters In our clinical use case, the AI Nurse may support users in scenarios involving medical symptoms, medications, risk events, disability care activities, and aged-care documentation. Under NMBA, AHPRA, and privacy regulations, we must demonstrate that all consumer and organisational data is handled in a safe, confidential, and legally compliant manner.

Hi there, Thank you for your message. Our team is currently out of the office. We operate Monday through Friday, from 9:00 AM to 8:00 PM Pacific Standard Time (PST). We’ll get back to you as soon as possible during our normal business hours. If your message is urgent, please mark it accordingly or include “URGENT” in the subject line, and we’ll do our best to respond promptly. Warm regards, Vapi Customer Support Team

To ensure sensitive call data is stored only in your chosen region (e.g., Australia), configure Vapi to use your own AWS S3 or GCP bucket and enable HIPAA mode to prevent Vapi from storing recordings or transcripts. Here’s a sample configuration:

json
{
  "hipaaEnabled": true,
  "artifactPlan": {
    "recordingUseCustomStorageEnabled": true,
    "loggingUseCustomStorageEnabled": true,
    "recordingPath": "https://your-bucket.s3-ap-southeast-2.amazonaws.com/recordings/",
    "loggingPath": "https://your-bucket.s3-ap-southeast-2.amazonaws.com/logs/"
  }
}

This setup gives you full control over data residency and retention—artifacts are stored only in your infrastructure, not on Vapi’s servers. For more, see the [Vapi data flow documentation](https://docs.vapi.ai/security-and-privacy/data-flow). Source: - [Vapi Data Flow Documentation](https://docs.vapi.ai/security-and-privacy/data-flow)

Thanks for the detailed context this is a high-risk healthcare use case where data residency, retention control, and auditability are critical. I help teams assess voice/AI platforms against strict clinical and privacy requirements and flag gaps early. I can review Vapi’s capabilities, risks, and possible safeguards in plain terms. Quick check to tailor this: is Australian-only data residency a hard requirement, or is offshore processing acceptable with strong controls? @Axia

Yes, Australian-only data residency a hard requirement. In our clinical use case, the AI Nurse may support users in scenarios involving medical symptoms, medications, risk events, disability care activities, and aged-care documentation. Under NMBA, AHPRA, and privacy regulations, we must demonstrate that all consumer and organisational data is handled in a safe, confidential, and legally compliant manner. Because of these duties, we cannot store or transmit identifiable health data outside Australia unless strict legal and contractual conditions are met.

With Australian-only data residency as a hard requirement, the priority is validating that no identifiable health data leaves Australia at any stage. I can help by assessing Vapi’s data flows (audio, transcripts, logs), identifying compliance gaps, and designing a regulator-aligned architecture that meets NMBA, AHPRA, and Privacy Act expectations. Where limitations exist, I’ll outline practical mitigation or alternative approaches that still support your AI Nurse objectives. Happy to discuss this further privately and keep the details confidential. @Axia

Thanks for reaching out on behalf of Axia Health Technologies. Given the sensitivity of your use case across aged care, disability support, and community health, we understand how critical Australian privacy and healthcare compliance is. Below is an overview of Vapi’s data handling and compliance capabilities. --- ### Compliance & Security Vapi supports: * HIPAA compliance for healthcare and PHI use cases * SOC 2 Type II certified security controls Security documentation: [https://security.vapi.ai/](https://security.vapi.ai/) --- ### Data Storage & Retention By default, Vapi stores: * Call recordings * Transcripts * Call logs and metadata Retention: * Pay-as-you-go: up to 30 days (chats), 14 days (calls) * Enterprise: configurable retention policies Storage controls: * Storage can be disabled via

hipaaEnabled: true

* When HIPAA mode is enabled, no recordings, transcripts, or logs are stored by Vapi * Custom storage buckets supported: * AWS S3 * GCP Cloud Storage * Azure Blob Storage * Cloudflare R2 * Supabase --- ### Encryption & Access Controls * Data in transit: TLS encrypted * Data at rest: encrypted storage * Strict role-based access controls * Tool argument encryption for sensitive fields * Regular security audits and penetration testing --- ### Data Residency & Australia-Specific Considerations * Custom storage buckets can be configured in Australian regions * Core Vapi orchestration runs on US/EU infrastructure but processes data ephemerally (not stored) * Azure OpenAI supports Australian regions for LLM processing * Regional isolation is achieved by routing recordings and transcripts directly to your own infrastructure --- ### HIPAA Mode When `hipaaEnabled: true`: * No call data is stored by Vapi * Only HIPAA-compliant providers are allowed: * OpenAI, Azure, Anthropic, Google, Deepgram, ElevenLabs, Cartesia * PHI passes through STT → LLM → TTS but is not retained * BAA is available --- ### Recommendation Given your requirements around: * Australian-only data residency * NMBA, AHPRA, and Australian privacy compliance * Clinical AI with sensitive health information We recommend a discussion with our sales / solutions team for: * Formal documentation on regional isolation * BAA process * Enterprise retention and storage controls * On-prem or advanced deployment options * Australia-specific regulatory guidance Sales: [https://vapi.ai/sales](https://vapi.ai/sales) Security: [security@vapi.ai](security@vapi.ai) Happy to clarify anything further.

Hey can you help me here to raise this issue : Bug: Azure

australia

region broken - need

australiaeast

I'm trying to add Azure Speech credentials for Australian data residency. Issue: Vapi lists

australia

as a region option, but it fails:

"Invalid API key. Azure Speech API returned getaddrinfo ENOTFOUND australia.tts.speech.microsoft.com"

Reason: Azure doesn't have an

australia

endpoint. The correct endpoint is

australiaeast.tts.speech.microsoft.com

Request: Please add

australiaeast

as a supported region option. My Azure endpoint:

https://australiaeast.api.cognitive.microsoft.com/

---