Cloud & DevOps Company in Melbourne

Two things move a Melbourne cloud number, environment count and the assurance regime you sit under: a scoped Melbourne cloud assessment with a Privacy Act + APRA CPS 234 + VPDSS (where relevant) review and a 90-day modernisation plan, a full AWS ap-southeast-4 Melbourne-primary landing zone with Terraform modules, GitOps pipelines, observability, Sydney DR, and APRA-aligned change control, or managed DevOps and SRE retainers. Scope drivers include environment count, on-call coverage, and CPS 230 critical operations drill participation. Melbourne rates sit close to Sydney and well below San Francisco, with the AUD-CAD differential and Chandigarh after-hours coverage producing a materially better total cost of ownership than Sydney-only competitors. Codazz quotes fixed fee where scope allows so finance teams can plan in AUD without T and M surprise.

AWS ap-southeast-4 opened in Melbourne in January 2023 with three Availability Zones and the bulk of the AWS service catalogue. For Melbourne-headquartered NAB, ANZ, AGL, REA, SEEK, MYOB, and the broader Victorian Government, Melbourne-primary architecture cuts network latency for staff and Victorian users, satisfies VPDSS expectations for in-state data handling more cleanly than Sydney residency, and aligns operational risk profiles under CPS 230 with where the business actually runs. Sydney remains the right DR region given the cross-state separation and the broader AWS service catalogue in ap-southeast-2. The pattern we deliver is Melbourne primary, Sydney DR — the inverse of what most lift-and-shift consultancies still default to, and the inverse of what made sense before January 2023.

APRA CPS 234 (Information Security, in force since 2019) requires APRA-regulated entities — banks, insurers, superannuation funds, and their material service providers — to maintain an information asset register, classify information assets by criticality and sensitivity, implement controls proportionate to that classification, test those controls regularly, and notify APRA of material incidents. CPS 230 (Operational Risk Management, effective from 1 July 2025) extends this with explicit obligations on critical operations, business continuity, and material service provider arrangements. For your cloud architecture we deliver a documented information asset register tied to AWS resource tags, control mappings into AWS Config or Azure Policy, a critical operations identification document with tolerance levels for disruption, a third-party risk assessment package suitable for material service provider notifications, and quarterly continuity drill participation that survives APRA review.

VPDSS (Victorian Protective Data Security Standards) applies to Victorian public sector bodies and their suppliers. It requires data classification (Public, Official, Official Sensitive, Protected, plus Cabinet-in-Confidence for relevant bodies), control implementation proportional to classification, supplier security clearance procedures, and annual attestation. Our VPDSS-aligned engagements deliver Terraform modules that tag every resource with VPDSS classification labels, AWS SCPs or Azure Policy enforcing classification-appropriate residency (Protected data forced to ap-southeast-4 Melbourne with no cross-border or cross-cloud egress), staff security clearance documentation for the Codazz engineers touching the environment, an annual attestation package, and Office of the Victorian Information Commissioner-ready incident response playbooks. We coordinate with Victorian Government CSCR (Cyber Security Capability Reference) expectations where they apply.

Yes. The Consumer Data Right (CDR) covers banking (Open Banking, live since 2020), energy (live since 2022 across NSW, ACT, QLD, SA, VIC), and is being progressively extended. CDR participation requires accredited data recipient or data holder status, FAPI-compliant API security, ACCC and OAIC reporting, and operational uptime obligations. Our CDR-aware infrastructure delivers FAPI-conformant authorization servers (typically Authlete, ForgeRock, or custom on Ory Hydra) deployed in ap-southeast-4 with ap-southeast-2 DR, mutual TLS termination at edge, dynamic client registration support, the consent dashboards data recipients are required to expose, and the OAIC notification workflows for any consumer data exposure incident. For Melbourne energy retailers we have also delivered the smart meter data ingestion patterns that CDR energy reads demand from AEMO and distributor systems.

The Australian Government accepted the bulk of the Privacy Act Review recommendations in late 2023, with first-tranche legislative changes through 2024 to 2025. The reforms tighten APP 8 cross-border transfer assessments, add direct rights of action for individuals, lower the small business exemption threshold over time, and tighten breach notification timelines. For your cloud architecture we deliver an APP 8 cross-border transfer assessment for every workload that crosses an Australian border (including AWS Sydney to AWS US East, or any third-party SaaS hosted outside Australia), a documented privacy impact assessment for each material new system, a 72-hour breach notification workflow wired into GuardDuty or Sentinel, and an APP 11 security-of-information control catalogue mapped to AWS Config or Azure Policy. We update the package annually as the reform tranches land.

A typical Melbourne cloud migration (lift-and-shift from on-premise, VMware, or another cloud into AWS ap-southeast-4 with Sydney DR, APRA-aligned change control, and VPDSS controls where relevant) takes eighteen to thirty weeks depending on workload count, database complexity, and APRA CPS 234 review depth. Week 1 to 4 is discovery and Australian residency mapping. Week 5 to 10 is landing zone build (Terraform modules, network segmentation, IAM, observability, APRA change management wiring). Week 11 to 22 is workload migration in waves with shadow traffic, blue-green deployments, and rollback gates. Week 23 to 28 is hardening, CPS 234 attestation prep, and VPDSS documentation packaging if relevant. Week 29 onward is steady-state with Codazz SRE on retainer. We have shipped to this cadence inside ANZ-adjacent and AGL-adjacent stacks.

Yes. The four Melbourne listings platforms collectively handle north of 10 million monthly active users with peaky search traffic, image-heavy listings, and ML-driven ranking and recommendation. Our listings-scale patterns deliver multi-region Aurora or Spanner-style sharding for the listings database, OpenSearch or Elasticsearch on ap-southeast-4 with cross-zone replication for search, CloudFront or Cloudflare with image optimisation for listings imagery (typical 70 percent egress reduction), event-driven pipelines on Kinesis or Pub/Sub for view tracking and behavioural signals into ranking models, and feature stores (SageMaker Feature Store, Feast on EKS) for personalisation. We have shipped these patterns at single-digit-percentage-of-revenue infrastructure spend, which is the bar Melbourne listings finance teams actually care about.