The ABC is reporting that the server must store data in Australia and the data cannot be transferred overseas.
The feds have been at pains to present COVIDSafe as having stringent privacy safeguards, but they have such an appalling record that few will believe them without trustworthy independent scrutiny. I can't see how that can be possible until (at a bare minimum) the app's source code is released.
I really hope they do, and that they make any necessary improvements subsequently recommended. Contact tracing is a fantastic potential use of mobile technology. It would be a pity for it to be undermined by the usual impulse towards contemptuous patrician secrecy.
7(3) If COVID app data is uploaded from a mobile telecommunications device to the National COVIDSafe Data Store, a person must not:
(a) retain the data on a database outside Australia; or (b) disclose the data to a person outside Australia.