If you run a small business in Australia, you have probably noticed every AI product you trial is hosted somewhere else. The terms of service are written for a US legal framework. The data residency clause is buried, vague, or missing. When you ask where your client data ends up, the answer is “we use AWS” and the conversation ends there.

Maren is hosted in Australia. Each customer runs on their own isolated tenant. The architecture is aligned to the Privacy Act 1988 and the Australian Privacy Principles from day one. None of that is a checkbox we ticked at the end. It was a constraint we designed for.

Here is what that means in practice for the small businesses that run on her.

Where the data lives

Your data sits on Australian infrastructure. That includes your knowledge register, every conversation, every workflow run, every audit log entry, every uploaded document. If you choose to plug in a connector that talks to an overseas service, that connector’s data flows to that service. But the Maren-side state stays in the region you chose.

For most Australian SMBs, this is not just a preference. It is a procurement requirement when you sell to government, healthcare, financial services, education, or any client with their own privacy obligations. Saying “our AI is hosted in the US but we promise it is fine” stops being a viable answer the moment a client asks for a data flow diagram.

Privacy Act alignment is built in, not bolted on

The Australian Privacy Principles cover thirteen specific obligations: how data is collected, used, stored, disclosed, accessed, corrected, and so on. The Maren architecture handles each of these as a first-class feature, not a policy document.

Examples that matter at the operational level:

• APP 6 — Use and disclosure. Every action Maren takes is recorded in an immutable audit log. You can produce a complete history of who did what with which data, on demand, without forensic effort.
• APP 11 — Security of personal information. Tenant isolation means one customer’s data is structurally separated from every other customer’s data, not logically separated through database filters that can fail.
• APP 12 — Access to personal information. A customer can export their entire register, audit log, and conversation history in machine-readable format. Right to access is a first-class API.
• APP 13 — Correction. Append-only with supersedes_id means corrections happen without losing history. The old record stays for forensic and dispute purposes; the new record supersedes it for current operations.

We did not design for compliance theatre. We designed for what happens when a regulator, a client, or your own auditor asks a hard question. The answer should be a query, not a project.

Tenant isolation as an engineering principle

A single Maren installation runs a single business. Even though we operate multiple customers, your tenant is its own scoped environment. Your knowledge register, your conversations, your connectors, your guardrails, your audit log. None of it bleeds across.

This is enforced at the database layer, not at the application layer. Tenant filtering happens before any query is allowed to execute. There is no scenario where a logical bug in a skill or workflow lets data leak between businesses, because the isolation is structural.

When a customer eventually leaves, they walk out with everything: a complete export of their tenant. Nothing of theirs stays in our systems by default.

Sovereignty without sacrificing model choice

A common worry with “Australian-hosted” AI is that it traps you with a small set of locally-hosted models. Maren does the opposite. Your choice of LLM is independent of where your data lives.

You can route requests to Claude through Anthropic, OpenAI, Gemini through Google, or Grok through xAI. You bring your own API keys, or you use Maren’s fallback credit while you onboard. The data stays in Australia. The inference goes to whichever provider you have chosen, with full cost transparency on your side.

That is not a compromise. It is the structure: model choice is a customer decision, data residency is a platform decision, and we made the platform decision the way Australian SMBs need it.

Why this matters for Cohort 1

Cohort 1 is opening to a small group of Australian small and mid-size businesses. The first conversations are about what Maren will run. The second conversations are usually about whether the architecture stands up to whatever compliance, audit, or insurance question their business has to satisfy.

The honest answer is that we built her for the Australian Privacy Act and the rules that will follow it, not for the lowest common denominator of US-headquartered SaaS. That decision shapes every layer of the platform, and it is the reason Cohort 1 makes sense as a starting market.

If your clients ask hard questions about data, your AI should give you good answers. That is what Maren is built for.