Background
An Australian fintech entering its licensing process found customer data stored, backed up and in two cases analysed offshore; the sub-processor chain crossed borders the application was required to itemise; and cryptographic keys sat in a key store whose regional posture had never been reviewed. The licence timeline allowed five months. A vendor quoted nine months and a re-platform.
Work performed
- Three weeks of forensic mapping produced the platform's first data inventory: every store, queue, cache, log sink, analytics export and backup target classified by data class and obligation.
- Four exposures remediated: analytics re-partitioned so Australian customer data is analysed in-region; backups rebuilt on Australian vaults with audited restore paths; two offshore stores migrated with rehearsed cutover; sub-processor terms renegotiated with flow-down obligations.
- Keys moved to an Australian key management configuration under Australian-entity custody; offshore administrative access removed; break-glass redesigned.
- Classification and region policy enforced by platform guardrails and pipeline checks; the licence evidence pack generated from platform telemetry.
Outcome
The licence was granted at the five-month mark with the residency obligations assessed as satisfied and no conditions on data handling. No service was re-platformed; run cost rose by the price of the Australian backup vaults and key configuration, approved in an eleven-minute board meeting. The firm's second product line launched on the same foundation without a further residency engagement.
One sub-processor dragged past its deadline on amended data terms; the firm escalated by tabling an alternative provider and the terms arrived within forty-eight hours.