Who builds on WattleDB

Most teams on WattleDB are building ordinary Australian software: a booking system, a portal, an internal tool, a product for one of the sectors below. Their customers ask two questions in writing: where is the data, and who can reach it. WattleDB answers both with one Australian company, and a Postgres database with an instant REST API that developers already know how to use.

If you are moving from Supabase, WattleDB shares its open-source core. PostgREST clients and tooling work against the REST API, and migration is a standard pg_dump and pg_restore over your direct connection string.

An agency that builds for a clinic, a practice or a shop usually ends up hosting the database too, and then fields the client’s security questions for years. WattleDB gives an agency one place to run many client databases, each isolated, each with its own credentials, on one invoice.

NDIS providers and aged-care providers are, in most cases, health service providers under the Privacy Act, so the small-business exemption does not apply to them. Their auditors ask for the same things every year: where records are held, who can see them, that backups exist and have been tested, and what happens when something goes wrong.

The NDIS Practice Standards require accurate, secure, access-controlled records handled in line with privacy law. The Aged Care Act 2024 and the strengthened Aged Care Quality Standards that commenced on 1 November 2025 require an information management system, digital where possible, managed under privacy law, with personal information used only for providing care and safeguarded with reasonable security measures.

Tax practitioners handle Tax File Numbers, financial statements and deeply sensitive client information. The Privacy (Tax File Number) Rule 2015 governs how TFN information is collected, used, stored and disclosed. The Tax Practitioners Board expects practitioners who use cloud services to know, and be able to disclose, where client data is stored and who can access it.

From 1 July 2026, accountants, bookkeepers and conveyancers who provide designated services are AML/CTF reporting entities, and the Privacy Act applies to their AML-related handling of personal information regardless of turnover, with records kept for at least seven years.

Law firms hold privileged communications and case files. Under the Australian Solicitors’ Conduct Rules, solicitors have a fundamental duty of confidentiality, and cloud storage raises the question every client eventually asks: who can reach the platform holding privileged material, and under whose law?

The honest answer is narrower than the marketing usually is. A hyperscaler’s Australian subsidiary is an Australian company bound by Australian law. What differs with WattleDB is that there is one accountable Australian company and one jurisdiction on the entire data path, with no overseas parent that a second government can compel and no foreign entity that operates the platform. That is a real difference, and it is not the same as immunity from Australian legal process, which no provider can offer.

From 1 July 2026, law firms providing designated services are AML/CTF reporting entities, and from 10 December 2026 automated decision-making transparency obligations apply to computer-programmed decisions that could significantly affect a person.

Health information is sensitive information under the Privacy Act, and health service providers have never had the small-business exemption. Under the My Health Records Act 2012, section 77 prohibits the System Operator, registered repository and portal operators and registered contracted service providers from holding or handling My Health Record data outside Australia. WattleDB is not a registered repository or portal operator, and does not claim to be; what it offers is that nothing you store with us leaves Australia.

General practices are accredited against the RACGP Standards, whose Criterion C6.4 asks for unique logins with role-based access, a business continuity and information recovery plan with a backup schedule that is tested, a secure off-site backup location, and agreements signed by external IT providers. State health records laws in Victoria and New South Wales permit records to be held interstate where the recipient is bound to equivalent protections, which a contract can do; we are adding a health annex that binds us to those principles expressly.

Childcare, construction, education technology, real estate and retail or hospitality software build on WattleDB on the same terms as any Australian SaaS team above. Two things to know. Card numbers and verification codes should never be stored in a WattleDB database or bucket; tokenise them with your payment provider (they keep the card and hand you a reference) so the database stays out of PCI DSS scope. And education technology vendors are assessed on their own product under Safer Technologies 4 Schools; we appear as evidence inside your answers, not as a certification of our own. Real estate and any other software that collects Australian addresses can pair WattleDB with WattleAddr, our address autocomplete and verification API.

Small ISPs, MVNOs (mobile resellers) and VoIP resellers can run billing, CRM and customer-portal databases with us. We have not yet published a Telecommunications Act Part 13 confidentiality clause; we will agree one in writing before you sign. We are not suitable for retained data under the data-retention regime, for carriage infrastructure, or for anything a carrier would declare as a critical asset.

APRA-regulated entities, government agencies and defence need an independent attestation in the provider’s own name, audit rights and assessed recovery times. We do not hold ISO 27001, SOC 2, IRAP or Hosting Certification Framework status today, so we are not the right fit for those workloads, and we would rather say so here than in month two of your procurement.