Microsoft 365 tenancies provisioned by bcom ICT are created in Australian regions, so client mail and files are stored in Australian data centres. Backup location is agreed per client and recorded in the agreement. Access to client systems uses individually named accounts with multi-factor authentication enforced — bcom ICT operates no shared logins into client environments.
What we actually hold
Managing your systems means holding some things about your business. This is the complete list, and the deliberate distinction throughout is between data about your environment and your business data — we hold a lot of the first and very little of the second.
| What | Detail | Where it sits |
|---|---|---|
| Your credentials | Administrative logins to your systems, held in a dedicated password management platform with individually named access and multi-factor authentication. Never in spreadsheets, documents or email. | Password management platform |
| Your asset register | Devices, licences, warranties, network layout and supplier details. This is documentation about your environment rather than your business data. | Our documentation system |
| Monitoring telemetry | Device health, patch status, disk space, security alerts. Operational data about your machines — not the contents of your files. | Monitoring platform |
| Support ticket history | What you asked, what we did, and any screenshots or logs attached to a job. Attachments can incidentally contain business information, so tickets are treated as confidential. | Ticketing system |
| Backup data | Only where bcom ICT provides backup as a service. Location is agreed with you and set out in your agreement. | Backup platform |
| Billing details | Business contact and billing information. bcom ICT does not store customer payment card numbers. | Accounting system |
Data sovereignty, including the caveats
Australian data residency has become a routine buying question, and the honest answer for almost every small IT provider has caveats. Here are ours.
- Microsoft 365 — tenancies we provision are created in Australian regions. Mail, files, Teams and SharePoint data stay in Australian data centres.
- Microsoft Azure — resources are deployed to Australian regions unless you specifically ask otherwise.
- Backup — Australian-hosted backup is available and is what we recommend. The location for your data is agreed and written into your agreement.
- Monitoring, ticketing and endpoint protection — some vendor platforms process operational data outside Australia. This is telemetry and support records, not the contents of your files, but it is not Australian-only and we will not pretend otherwise.
- If Australian-only processing is a hard requirement — say so before we start. It is achievable but it constrains the tooling, and that is a design decision rather than a switch we can flip later.
We'll name every platform holding anything of yours, on request. If a provider won't do that, it's worth asking why.
Access control
If we manage your systems, we hold keys to them. That deserves stating plainly rather than being buried in a schedule.
- Named individual accounts for every technician — no shared logins into client environments
- Multi-factor authentication enforced on every tool used to reach a client system
- Client credentials in a dedicated password management platform, never in documents or email
- Access reviewed when staff change, and revoked the day someone leaves
- Every access attributable to a person, which is the entire point of doing it this way
- Technicians attending sites hold national police checks; Queensland Blue Cards where the site requires them
Retention and deletion
When an engagement ends, credentials, asset register and documentation are handed over to you. Ticket history and billing records are retained for the period our legal and insurance obligations require, then deleted. Backup data held on your behalf is returned or destroyed as you direct, and we confirm in writing which of those happened.
You can ask for a copy of your documentation at any point during the relationship, not only when leaving. It's yours.
Your business has its own obligations under the Privacy Act and the Notifiable Data Breaches scheme for the personal information you hold. Our role is helping you meet them, not assuming them for you — the NDB guide sets out how that division works when something goes wrong.
What people actually ask about their data
Six questions worth putting to any provider, including two most businesses never think to ask.
“Where does our data physically sit?”
Usually a question that used to be rare and is now asked in most supplier questionnaires. It matters for the Privacy Act, for some contracts, and for a few sectors specifically.
What we do Establish it for each system rather than in general. Businesses commonly assume all their data is in Australia, and a service adopted informally by one department is frequently the exception.
“Who at your company can reach our systems?”
Usually a question every client is entitled to ask their provider and very few do.
What we do Ask it, and ask how access is controlled. Technician access here is individually named with no shared logins into client environments, multi-factor authentication is enforced on every tool that reaches a client system, and access is revoked on the day someone leaves.
“Do you keep copies of our data?”
Usually a reasonable concern, particularly for businesses holding client or health information.
What we do Get the answer in writing and get it specific — what is held, where, for how long and why. A provider that cannot answer that precisely has not thought about it.
“What happens to it if we leave?”
Usually the question that separates providers, and the one asked least often at the start.
What we do Ask before you sign, not afterwards. Documentation, credentials, asset registers and configuration notes should be yours on request at any time, and a clean exit should not require a negotiation.
“Is data sovereignty actually a legal requirement for us?”
Usually sometimes, and less often than assumed. The Privacy Act regulates disclosure to overseas recipients rather than prohibiting offshore storage outright, and specific sectors carry their own rules.
What we do Establish your actual obligation rather than adopting a blanket position. Businesses handling health information or working under government contracts most often have a genuine requirement.
“Our staff use tools we never approved”
Usually shadow adoption. Someone needed to do something and found a tool that worked, which is usually resourcefulness rather than misconduct.
What we do Find out what is genuinely in use before writing a policy about it. A policy that prohibits the only tool doing a necessary job gets ignored, and then nobody knows anything.
What this looks like in practice
Representative engagements, drawn from real work with identifying detail removed — we don’t name clients without written permission.
The one system that was not where everyone assumed
The situation
A business completing a client security questionnaire needed to confirm that all client data was held in Australia. The directors were confident it was and asked us to verify it as a formality.
What we found
Nearly everything was. One exception: a file transfer service adopted three years earlier by a team that needed to send large documents to clients, chosen because it worked and never assessed by anyone. It stored data in a region outside Australia, and it had been carrying client material for three years. Nobody had done anything wrong — the team had a job to do and no sanctioned tool for it.
What we did
Established where every system genuinely held data, moved the file transfer function into the business’s own tenancy where it belongs, and recorded the position for each system so the next questionnaire is a lookup rather than an investigation.
The outcome
The questionnaire was answered accurately. The useful outcome was the register, because the question is now asked routinely and the answer needs to be available rather than reconstructed each time.
A clean exit, from the other side of it
The situation
A business joining us was leaving a provider it had used for eight years. The relationship had ended reasonably and the handover was expected to be straightforward.
What we found
Very little existed to hand over. There was no asset register, no network documentation and no diagram. Credentials for the firewall, the domain registrar and two cloud services were held only by the outgoing provider, and some had been set up under that provider’s own accounts rather than the client’s. Nothing had been withheld maliciously — it had simply never been created or never been transferred.
What we did
Rebuilt the documentation from the environment itself, recovered ownership of each account through the relevant provider’s process, and moved everything into accounts the business owns. Then gave the business the complete set, on the basis that it should hold it regardless of who supports it.
The outcome
The business owns its own environment for the first time in eight years. This is why we publish what a client gets on the way out — not because we expect anyone to leave, but because being able to is the point.
Questions Gold Coast businesses ask us
Where does our data live if bcom ICT manages our systems?
Microsoft 365 tenancies that bcom ICT provisions are created in Australian regions, so mail and files are stored in Australian data centres. Where bcom ICT provides backup as a service, the storage location is agreed with you and recorded in your agreement. bcom ICT will tell you the location of every system holding your data on request.
Is our data sovereign — does it stay in Australia?
For the parts we control, yes by default. Microsoft 365 tenancies we provision use Australian regions, and Australian-hosted backup is available. Some vendor platforms we use for monitoring and ticketing process data outside Australia, which we'll tell you about rather than gloss over. If Australian-only processing is a hard requirement for your business, say so at the start and we'll design around it — it does constrain the tooling.
Who at bcom ICT can access our systems?
Named technicians, using individual accounts with multi-factor authentication enforced. There are no shared logins into client environments. Access is reviewed when staff change and revoked the day someone leaves. Every access is attributable to a person, which is the point of doing it this way.
Do you read our emails or files?
No. Managing a Microsoft 365 tenancy means we can administer mailboxes — create them, restore them, fix permissions. It does not mean we read their contents, and we don't. Where a support job genuinely requires looking at a specific message or file, we ask you first.
What happens to our data if we stop using bcom ICT?
Credentials, asset register and documentation are handed over to you. Ticket history and billing records are retained for the period our legal and insurance obligations require, then deleted. Backup data held on your behalf is returned or destroyed as you direct, and we'll confirm in writing which happened.
Are you covered by the Privacy Act?
bcom ICT handles personal information belonging to clients and their staff, and treats it under the Australian Privacy Principles. Your business has its own obligations under the Privacy Act for the data you hold — our role is to help you meet them, not to assume them for you. Our notifiable data breach guide sets out how that works when something goes wrong.
Do you use subcontractors who could reach our data?
Three categories, and we're explicit about each. Cabling is carried out by ACMA registered cabling contractors — they work on physical infrastructure and are not given access to your systems or data. Vendor platforms for monitoring, ticketing and endpoint protection process operational data as part of delivering those services. For clients on our security operations centre service, a specialist third-party security provider's analysts monitor, investigate and respond to security alerts under the rules of engagement agreed with you; we explain what the provider can access, and where it operates, during consultation. We'll name the platforms and the provider on request.
Need this for a supplier assessment?
If a client or insurer is asking you questions about your IT provider, send them this page — or ask us for whatever else they need.