Background
An Asia-Pacific enterprise software provider signed its first Australian customer, a financial services group. The contract required Australian data residency, a structured security assessment, Australian business-hours coverage and a go-live date nine weeks out. The platform ran in a single offshore region with tenant data not separated per customer.
Work performed
- Tenant partition architecture: Australian customer data isolated at storage and encryption layers, tenant routing enforced at ingress, keys held in an Australian store under the provider's Australian entity.
- Security assessment rebuilt from architecture evidence — control mappings, diagrams, test results; gaps closed as engineering work with dates.
- Sydney point of presence for latency; Australian-hours operations rotation with defined escalation into the engineering centre.
- Decision-rights matrix negotiated and signed by headquarters: which decisions the Australian operation takes alone.
- Joint operating cadence coached for six weeks: daily written handover, weekly engineering review, exercised escalation path.
Outcome
The first Australian workload went live in week nine with residency, security and operational evidence complete. The second Australian customer, signed two months later, onboarded in eleven days on the same foundation. The decision-rights matrix remains the standing agreement between headquarters and the Australian operation.
The first fortnight ran slower than planned: three partition-design reviews at headquarters each raised edge cases and cost days. Flying the Australian lead to headquarters in week one would have resolved them faster.