1. Purpose
1.1 This Schedule describes where MAITS's standard platform stores and processes data, and the providers involved. It forms part of the Master Services Agreement and the Data Processing Agreement.
2. Standard platform
| Function | Provider | Location |
|---|---|---|
| Application services | Microsoft Azure Functions | Australia East |
| Databases and queues | Microsoft Azure Storage | Australia East |
| Documents and invoice archive | Microsoft Azure Storage | Australia East (replicated across zones in that region) |
| Secrets | Microsoft Azure Key Vault | Australia East, with replication within the Australian geography under Microsoft's service terms |
| Monitoring | Microsoft Application Insights and Log Analytics | Australia East, kept for 30 days |
| Transactional email | Microsoft Azure Communication Services | Data location: Australia. Delivered to recipients' mail providers. |
| Website delivery | Microsoft Azure Static Web Apps | Microsoft global network |
| Sign-in | Microsoft Entra External ID | Operated by Microsoft under its service terms |
| Payments | Stripe | Processed by Stripe internationally, including in the United States |
| AI-assisted features | Microsoft Azure OpenAI (global deployment) | May be processed in any Azure region |
| Website fonts | Google Fonts | Google global infrastructure |
3. Residency commitments
3.1 The standard platform is hosted in Australia, with the international processing described above. It is not a New Zealand-only or Australia-only service.
3.2 Organisations can record hosting and residency requirements in the Portal. Available options are:
- New Zealand hosting;
- Australian hosting;
- a customer-owned Azure tenant;
- private hosting;
- restricted external processing; or
- custom backup or retention requirements.
3.3 MAITS assesses each requirement, and confirms in writing its feasibility and any additional Fees, before provisioning. A mandatory requirement must be approved before a service that depends on it is provisioned.
4. Changes
4.1 MAITS may change providers or locations. It will update this Schedule before a change that affects where Customer Personal Information is processed.