Ask for a data flow, not a country badge
Start with the information your proposed use would place into the system. Distinguish ordinary business contacts from laboratory records and any personal or sensitive information. Then ask which service receives each category and for what purpose.
A simple supplier table is often more useful than a broad slogan:
| Part of the service | Question to ask |
|---|---|
| Primary application and database | Where is the agreed environment located? |
| Backups and recovery | Where are copies stored, and which recovery arrangement is included? |
| Application and security logs | What record content or identifiers enter logs? |
| Notifications | Which provider handles them, and what is included in the message? |
| Support and administration | Who can access the environment, from where and under what process? |
| Connected services | Which additional processors or integrations are involved? |
| Exit and deletion | What can be exported, and what is retained after the arrangement ends? |
The table is an original procurement aid. The answers must come from the proposed service configuration, not from a generic architecture diagram.
Distinguish a website enquiry from product use
A supplier’s marketing website may use a different database, email service and retention process from its product. A website privacy notice is therefore not automatically a sufficient description of the service you intend to use.
Ask for the product-specific information relevant to your proposed pilot. Where a detail is undecided, record it as undecided. Avoid treating an answer about a contact form as proof about a production laboratory environment.
Determine which privacy obligations apply
The OAIC explains that many small businesses are outside the Privacy Act’s coverage, but exceptions apply. The relevant assessment depends on the organisation and its activities; neither a small headcount nor a laboratory-related product label settles the question. See the OAIC’s small-business guidance.
Where the Australian Privacy Principles apply, overseas disclosure raises additional considerations. The OAIC’s overseas-information guidance provides the starting point. Obtain advice for your circumstances rather than assuming any overseas processing is automatically prohibited or automatically acceptable.
Ask for evidence at the right level
A statement that a control exists should identify its scope. Does the answer apply to the pilot environment, the proposed production service or only the public website? When was it verified? Is it a current arrangement or a planned change?
For sensitive technical evidence, an appropriately controlled private review may be more suitable than a public page. That does not remove the need for an answer. An unavailable document and a confidential document are different things.
Keep the pilot data boundary small
Use synthetic data until the relevant parties have agreed the purpose, access arrangements, security expectations and commercial conditions. Do not use a marketing enquiry form to send patient information or confidential laboratory records in order to ask whether a product is suitable.
During a scoped evaluation, agree which records will be created, who can access them and how they will be handled afterwards. Include exports, deletion and any justified retention in that discussion. Avoid promising that every copy can be instantly erased unless the service can substantiate the claim.
Record the decision, including limitations
A useful procurement outcome is a short, approved statement of the service being assessed, its relevant processing arrangements and any unresolved conditions. “Hosted in Australia” may be one fact in that statement; it is not the whole assessment.
Review AureqoLab or AureqoEq for product scope. Use a Request a product walkthrough to raise data-handling questions before a pilot, without including the sensitive records themselves.