APAC zone / apac-in-country
In-country AI inference for Singapore, Australia, India and Japan
Country-level routing across Singapore, Sydney, Mumbai and Tokyo, with transfer rules written as policy and proof on every response.
Route card / APAC
base_url https://apac.yttsecunet.com/v1
X-YTT-Policy apac-in-country
endpoints 5 certified, 3 providers
primary Sydney
failover Melbourne, in-country only
never Singapore, for Australian tenants
plans Enterprise, Dedicated
| Instrument | Citation | What it means for an inference call |
|---|---|---|
| Singapore Personal Data Protection Act 2012 | PDPA s. 26; Personal Data Protection Regulations 2021, Part 3 | The transfer limitation obligation: personal data may leave Singapore only if the recipient is bound by legally enforceable obligations giving a comparable standard of protection. Financial penalties can reach 10% of annual Singapore turnover for organisations above S$10 million, otherwise S$1 million. |
| Australian Privacy Act 1988, APP 8 | Privacy Act 1988 (Cth), Schedule 1 APP 8 and section 16C | Before disclosing personal information overseas, an entity must take reasonable steps so the recipient does not breach the APPs, and under s. 16C it generally remains accountable for the recipient's acts. The Privacy and Other Legislation Amendment Act 2024 added a mechanism to prescribe countries with substantially similar protection. |
| India Digital Personal Data Protection Act 2023 | DPDP Act 2023, section 16; DPDP Rules 2025, rule 15 | A negative-list model: the Central Government may restrict transfers to notified countries, and stricter sector rules continue to apply under s. 16(2). The Rules were notified in November 2025, with most substantive obligations commencing eighteen months later. |
| Japan Act on the Protection of Personal Information | APPI, Article 28 | Transfers to third parties in foreign countries need prior consent with information about the destination's regime, an adequate-country basis (the EEA and the UK), or a recipient with equivalent measures. |
Singapore: PDPA s. 26 and the comparable-standard test
Singapore does not require data to stay in Singapore. Section 26 of the PDPA and Part 3 of the Personal Data Protection Regulations 2021 allow transfers when the recipient is bound by legally enforceable obligations, such as a contract or binding corporate rules, that give a standard of protection comparable to the PDPA. In practice, regulated firms add their own constraints: MAS outsourcing guidelines and the expectations of public sector customers often lead to Singapore-only processing for customer data.
The APAC zone lets each Singapore tenant choose. A strict tenant routes only to Singapore endpoints. A tenant relying on s. 26 contracts can allow named destinations, and the receipt records the destination so the data transfer record in your PDPA documentation matches actual traffic.
Australia: APP 8 accountability and why location still matters
APP 8 is an accountability rule more than a localisation rule. Before disclosing personal information to an overseas recipient, an Australian entity must take reasonable steps so the recipient does not breach the APPs, and section 16C generally makes the entity accountable for what the recipient does. For an AI feature, every prompt that reaches an overseas model endpoint is a disclosure that the entity owns.
Many Australian buyers sidestep the analysis by keeping inference in Australia. APRA-regulated entities also manage service providers under Prudential Standard CPS 230, which applies from 1 July 2025. YTT Secunet routes Australian tenants to Sydney regions by default, and the Tax File Number, Medicare number and Australian passport patterns are masked in-path when a tenant allows any overseas route.
India and Japan in brief
India's DPDP Act takes the opposite approach to the EU: transfers are allowed except to countries the Central Government notifies as restricted, and sector rules can be stricter. RBI's payment data storage direction, for example, requires payment system data to be stored only in India. YTT Secunet routes Indian tenants to Mumbai or Pune capacity by default, which satisfies both the general Act and the stricter sector expectations most Indian banks and insurers apply.
Japan's APPI Article 28 allows foreign transfers with informed consent, to countries the PPC recognises as adequate (the EEA and the UK), or to recipients that maintain equivalent measures. Japanese enterprises often keep inference in Tokyo to avoid consent mechanics in customer-facing products. The Tokyo route is available for Japanese tenants with the same receipt format as every other zone.
Country-level, not region-level, routing
Asia-Pacific is not one legal zone. A Sydney request failing over to Singapore crosses a national border and creates a disclosure under APP 8; a Singapore request failing over to Tokyo is a transfer under s. 26. The APAC zone therefore works at country level: each tenant has a home country, failover stays inside it, and any cross-border route has to be listed in the tenant's policy with the transfer basis recorded. APAC routing is available on Enterprise Sovereign, and policies for this zone are written as custom Rego starting from the template below.
Where our responsibility stops
YTT Secunet enforces where inference runs and signs a receipt for it. It does not give legal advice and does not replace your DPIA or transfer impact assessment.
Each entry is a specific deployment, not a provider as a whole. The registry pins region and deployment type, and refuses a route to a model the region does not serve instead of falling back to another zone.
Amazon Bedrock
ap-southeast-1, Singapore
In-region model IDs only; APAC cross-region profiles can leave Singapore.
Google Cloud Vertex AI
asia-southeast1, Singapore
Regional endpoint only; global endpoint refused by policy.
Microsoft Azure OpenAI
Australia East, Sydney
Regional Standard deployments for Australian tenants.
Amazon Bedrock
ap-south-1, Mumbai
Default route for Indian tenants; in-region model IDs only.
Microsoft Azure OpenAI
Japan East, Tokyo
Regional deployments for Japanese tenants.
This is the rule set the gateway evaluates for Asia-Pacific traffic. Your application names it in the X-YTT-Policy header, pinned to a version, and the decision is made before the request is forwarded to any provider.
- Evaluated by Open Policy Agent in the regional data plane, under 3 ms median (YTT Secunet production telemetry)
- Pack id and version are written into every signed receipt, so an auditor can match traffic to the rule that allowed it
- A denial returns HTTP 451 with the decision id and reason; there is no silent reroute
- Legal teams review changes in the visual policy editor before engineering merges them
package yttsecunet.apac_in_country
default allow := false
# Default: process in the tenant's home country.
allow if {
input.endpoint.country == input.tenant.home_country
input.endpoint.deployment_type == "regional"
}
# A cross-border route must be listed with its transfer basis.
allow if {
some route in input.tenant.approved_routes
route.country == input.endpoint.country
route.basis in {"pdpa_s26_contract", "app8_reasonable_steps", "appi_art28_consent"}
input.pii.masked
}
deny contains msg if {
not allow
msg := sprintf("no approved route from %s to %s", [input.tenant.home_country, input.endpoint.country])
}Within the tenant's home country only: Sydney never fails over to Singapore. Resilience comes from a second facility or provider inside the zone. If none is healthy the gateway refuses the request rather than sending it to the nearest region across the border.
- Client app, tenant domicile APAC, calls apac.yttsecunet.com
- Primary: Sydney
- In-zone failover: Melbourne, in-country only
- Never: Singapore, for Australian tenants. With no healthy in-zone endpoint the gateway fails closed with HTTP 503.
Does Singapore law require data to stay in Singapore?
Not as a general rule. PDPA s. 26 allows transfers to recipients bound by comparable protection. Sector regulators and customer contracts often require Singapore processing, which is why YTT Secunet supports both postures per tenant.
Is sending a prompt to an overseas model a disclosure under APP 8?
Generally yes, when the prompt contains personal information and the overseas provider is not acting under the entity's effective control. Keeping inference in Australia avoids the APP 8 analysis for that traffic.
Is India's cross-border rule in force?
The DPDP Rules were notified in November 2025 and most substantive obligations commence eighteen months later. No restricted-country list had been notified at the time of writing, but sector rules such as RBI's payment data storage direction already require local storage for some data.
Which plan includes APAC routing?
Enterprise Sovereign and Sovereign Dedicated. Growth covers the EU, UK and US zones.
Sovereign route ready
Route APAC inference inside the APAC zone, with proof.
Change the base URL, name the policy pack, and every response carries a signed residency receipt your DPO can verify offline.