Where a security awareness platform stores learner data matters to Australian businesses under the Privacy Act 1988. This guide ranks the major awareness platforms by what they actually publish about data residency in 2026 — and shows you how to verify the rest before you sign.
TL;DR
- KnowBe4 publishes a data storage locations article: US, EU, UK, Canada and Germany hosted instances, with personal data generally processed in the United States — no Australian location published.
- Huntress documents US-based data centres for its platform, including its security awareness training product.
- Cyber Aware, uSecure, Breach Secure Now, Hornetsecurity, Terranova Security and CyberHoot publish no public data-residency map as of July 2026 — ask each vendor directly.
- The Privacy Act 1988 holds Australian organisations accountable for personal data disclosed overseas, even when a vendor holds it.
- Verify three things before signing: the country of storage, the cloud provider, and the sub-processor list.
Why data residency matters for awareness platforms
A security awareness platform holds a surprisingly sensitive dataset: every employee's name, work email, phishing click history, quiz results and, in some platforms, breach-exposure alerts. Cyber Aware's human risk reporting, for example, checks learner emails against the Have I Been Pwned breach database in the background — which means the platform must hold and process those email addresses continuously.
Under the Privacy Act 1988, the Australian Privacy Principles make the disclosing organisation accountable for personal data it passes to an overseas recipient. If a training platform processes learner data in another country, your organisation — not the vendor — carries the accountability. Principle 11 adds a security obligation over that data, and the Notifiable Data Breaches scheme applies to eligible breaches wherever the data sits.
Data residency is not a compliance formality. It determines which subpoena, which breach notification law and which cloud outage reaches your learner data.
How the ranking works
Platforms are ranked by residency transparency: whether the vendor publishes where learner data is stored, in enough detail to write into a privacy impact assessment. "Not published" is not automatically a dealbreaker — several strong platforms simply answer the question in a sales call — but a published, specific answer is verifiable, and verification is the point of this ranking.
Awareness platforms ranked by data residency, at a glance
| Platform | Published residency | Australian hosting published? | How to confirm |
|---|---|---|---|
| KnowBe4 | US, EU, UK, Canada, Germany instances; personal data generally processed in the US | No | Support article |
| Huntress SAT | US-based data centres | No | Support documentation |
| Cyber Aware | No public residency page | Not published | Ask in the demo |
| uSecure | No public residency claim | Not published | Ask in the demo |
| Breach Secure Now | No public residency claim | Not published | Ask in the demo |
| Hornetsecurity | EU-headquartered vendor; training service residency not itemised | Not published | Ask in the demo |
| Terranova Security | No public residency claim | Not published | Ask in the demo |
| CyberHoot | No public residency claim | Not published | Ask in the demo |
1. KnowBe4: the most published residency detail
KnowBe4 maintains a public support article listing its data storage locations: hosted instances in the United States, European Union, United Kingdom, Canada and Germany. According to Cyber Aware's July 2026 comparison guide, personal data is generally processed in the United States per KnowBe4's own documentation, and no Australian data-storage location is referenced on knowbe4.com.
Verdict: Best transparency in the category — you can cite the storage map directly in a privacy assessment. Skip if Australian hosting is a hard requirement; the published list does not include it.
2. Huntress: US data centres, documented
Huntress states in its support documentation that data is held in US-based data centres, and the same applies to its managed Security Awareness Training product. That is a clear, checkable answer — just one that points at one country.
Verdict: Buy for organisations comfortable with US storage and the Accountability Principle obligations that come with it. Skip if you need in-country storage for government or defence-adjacent work.
3. Cyber Aware: purpose-built for Australia, residency unpublished
Cyber Aware is an Australian-built human-risk platform — training, phishing simulations and gap assessments mapped to Essential 8 and SMB1001 — but as of July 2026 it does not publish a data-residency page. The honest position for a buyer: the Australian framework mapping is documented, the residency is not, so put the question in the demo before you contract.
Verdict: Strong fit for Australian SMBs and MSPs on frameworks and reporting — with one verification question to close first.
4. The rest: no published residency claim
uSecure, Breach Secure Now, Hornetsecurity, Terranova Security and CyberHoot publish no public data-residency claim in the materials reviewed for the July 2026 comparison guide. Hornetsecurity is an EU-headquartered vendor, which some buyers read as an EU-processing signal, but the awareness service's storage location is not itemised publicly. None of this means the data is stored somewhere unacceptable — it means the answer lives in the sales conversation instead of on the website.
Verdict: Ask each vendor for country of storage, cloud provider and sub-processor list in writing before signing.
How to verify data residency before you buy
Four steps, in order:
- Check the vendor's own documentation first. A published storage map beats a sales assurance, because it survives staff turnover and acquisitions.
- Ask three questions in writing. Which country is learner data stored in? Which cloud provider and region? Which sub-processors touch the data, and where are they?
- Map the answer to the APPs. If data leaves Australia, confirm your privacy policy discloses the overseas disclosure and your vendor contract flows down the security obligation.
- Re-verify at renewal. Residency changes quietly — a new sub-processor or a migrated region shows up in no notification you are guaranteed to read.
FAQ
Where does KnowBe4 store its data? KnowBe4 publishes hosted instances in the US, EU, UK, Canada and Germany, with personal data generally processed in the United States per its own documentation. No Australian location is published.
Where does Huntress store security awareness training data? Huntress documents US-based data centres for its platform, including the managed awareness training product.
Does Cyber Aware store data in Australia? Cyber Aware does not publish a data-residency page as of July 2026 — confirm country of storage, cloud provider and sub-processors with the vendor before contracting.
Is US data storage legal for Australian businesses? Yes, provided your organisation meets the Australian Privacy Principles' requirements for cross-border disclosure and security — the accountability sits with you, not the vendor.
What learner data does an awareness platform hold? Names, work emails, training completion records, quiz results, phishing simulation clicks and reports, and sometimes breach-exposure alerts tied to each email address.
What is the single best residency question to ask a vendor? "Which country is my learner data stored in, and which sub-processors can access it?" — asked in writing, with the answer filed against the contract.
One last thing
The platforms with the deepest content libraries are often the vaguest on residency. Treat a vendor's willingness to name a country, a region and a sub-processor list as a proxy for how they will treat every other hard question you ask them.