The short answer
All Webbed Labs is a Sydney-based team that provides AI consulting and custom software development for Melbourne organisations remotely, flying down for workshops when being in the room matters. Victorian projects have their own rules: state agencies buy ICT through the Digital Marketplace and the mandatory eServices register, work under the Privacy and Data Protection Act 2014 and the VPDSS, and handle health data under the Health Records Act 2001. Data can stay in Victoria using AWS, Azure or Google Cloud regions in Melbourne.
Key takeaways
- We're based in Sydney, deliver to Melbourne remotely and travel for workshops and user testing; we have no Melbourne office.
- Victorian agencies buy ICT services through the Digital Marketplace, where the eServices register is mandatory for the ICT services it covers; suppliers join via Supplier Hub.
- Victorian public sector bodies must meet the 10 Information Privacy Principles in the PDP Act, and many must also meet the 12 mandatory VPDSS standards.
- The Health Records Act 2001 applies Health Privacy Principles to health information in both the Victorian public and private sectors.
- AWS opened its Melbourne region (ap-southeast-4) in January 2023, so Victorian workloads can stay in-state, with Sydney as a second region.
Can a Sydney team deliver well for a Melbourne organisation?
Yes, if it’s honest about the model: our team is based in Sydney, we build remotely, and we fly to Melbourne for workshops and user testing when being in the room matters. Melbourne and Sydney share a time zone all year, including daylight saving, so there’s no scheduling penalty. We don’t have a Melbourne office or phone number.
So if you’re comparing AI consultants or software development companies in Melbourne, the fair comparison is on process and evidence, not postcode. What is different about Melbourne work isn’t the distance. It’s the Victorian rules that apply to state agencies, their suppliers and anyone handling health information, and the fact that Melbourne has its own cloud regions. The rest of this page covers those.
Which Melbourne sectors are commissioning custom software and AI?
Melbourne has large health and medical research, university, superannuation and financial services, manufacturing, and freight and logistics sectors. Each shapes what gets built:
| Sector | Typical software and AI projects | Victorian rules that often apply |
|---|---|---|
| Health, aged care and medical research | Clinical document processing, referral and intake systems, research data platforms | Health Records Act 2001 (Vic) and the Privacy Act 1988 |
| Universities and education providers | Student support assistants, course and compliance systems, research tooling | PDP Act for public bodies; Health Records Act where health data is held |
| Superannuation and financial services | Member service assistants, document and claims automation, internal knowledge search | Privacy Act; APRA prudential standards for regulated entities |
| Manufacturing | Quoting and scheduling systems, quality inspection, ERP integrations | Mostly contractual and Privacy Act |
| Freight and logistics | Dispatch, tracking and customer portals, document extraction for shipping paperwork | Mostly contractual and Privacy Act |
| State agencies and councils | Case management, service delivery portals, internal AI assistants | PDP Act, VPDSS, Health Records Act where relevant |
Our solution pages for healthcare, financial services and logistics go deeper on each industry.
How do Victorian agencies buy software?
Victorian Government buyers use the Digital Marketplace on Buying for Victoria, and suppliers register through Supplier Hub. Only approved Victorian departments and agencies can hold Digital Marketplace buyer accounts; businesses manage their profile, insurances and certifications in Supplier Hub and then apply to join a register.
For custom software, the key arrangement is the eServices register. Buying for Victoria lists it as mandatory, led by the Department of Government Services, in place since 1 July 2013 and open to new supplier applications at any time. It covers ICT professional services, cloud services, software, ICT maintenance and support, and ICT design, development and implementation.
The Digital Marketplace also holds state purchase contracts with vendors such as AWS, Google, Microsoft, Salesforce and ServiceNow. Buyers don’t need approval to use the eServices register, but most other state purchase contracts require written authorisation from the agency’s chief procurement officer, CFO or CEO. For vendors, our guide to selling software to Australian government covers state and federal pathways side by side.
Which Victorian privacy and security laws apply?
Victorian public sector organisations must handle personal information under the 10 Information Privacy Principles in Schedule 1 of the Privacy and Data Protection Act 2014 (Vic), and agencies and bodies covered by Part 4 of that Act must meet the Victorian Protective Data Security Standards. Health information is covered separately by the Health Records Act 2001 (Vic).
The PDP Act and VPDSS
The VPDSS set 12 high-level mandatory standards covering governance, information, personnel, ICT and physical security, overseen by the Office of the Victorian Information Commissioner (OVIC). Agencies submit a Protective Data Security Plan every two years with an annual attestation from the agency head, and are encouraged to notify OVIC of information security incidents with a “limited” business impact or higher.
For a supplier, that shows up as contract requirements: access controls, audit logging, security classification handling and incident notification that feed the agency’s plan.
The Health Records Act 2001
The Health Records Act sets Health Privacy Principles for health information collected and handled in Victoria by both the public and private sectors, and gives people an enforceable right to access their health records held by private organisations. Complaints go to the Health Complaints Commissioner. It covers health, disability and aged care information across a wide range of organisations, not just clinics and hospitals. The OAIC notes private health providers in Victoria must comply with both the Commonwealth Privacy Act and the state law.
What this means for the build
| Obligation | Design feature it drives |
|---|---|
| IPPs on collection, use and disclosure | Data maps showing what each feature collects and why |
| VPDSS access and ICT controls | Role-based access, audit logs, protective marking support |
| OVIC incident notification | Monitoring and logs good enough to scope an incident quickly |
| Health Records Act access rights | The ability to find and export everything held about one person |
| HPP retention and security requirements | Retention rules and secure deletion built in, not bolted on |
Where should Victorian data be hosted?
Victorian workloads can stay in Victoria: AWS opened its Asia Pacific (Melbourne) region, ap-southeast-4, in January 2023, joining Azure Australia Southeast and Google Cloud australia-southeast2. Having full regions in both Melbourne and Sydney means a Victorian system can run in Melbourne with backups and failover in Sydney, keeping all data in Australia.
For AI features, check model availability region by region. At the time of writing, availability can differ between the Melbourne and Sydney regions for the same provider, and it changes often. For Microsoft-heavy organisations, our Copilot vs custom AI assistant guide is the usual starting point. Our comparison of Bedrock, Azure OpenAI and Vertex AI for Australian residency covers how to check.
What a Melbourne engagement looks like, week by week
The in-person time is front-loaded, and the rest runs on a fixed remote rhythm. A typical path for a first release:
- Week 1: discovery workshop in Melbourne. One or two days at your office with the process owner, the people who do the work, and IT or security.
- Weeks 2 to 3: data, access and architecture. Remote. We confirm hosting region, integrations and any VPDSS or Health Records Act requirements, and produce a fixed-price proposal.
- Weeks 4 onward: build. Remote, with a written plan each Monday and a working demo each Friday on a staging environment.
- Before release: user testing in Melbourne. We sit with real users, watch where they struggle, and fix it before the wider rollout.
- After release: support. Monitoring, fixes and improvements under an agreed support arrangement.
Because Melbourne and Sydney share a time zone, a Friday demo at 3pm is 3pm for everyone, which isn’t true for Brisbane or Perth for half the year.
How All Webbed Labs works with Melbourne organisations
Founder Andy Taleb has been building software professionally since 2019 and running All Webbed Up since 2021, and All Webbed Labs launched in mid 2026 as a partnership with a group of senior developers and founders. For Melbourne clients we run discovery as an in-person workshop, then build remotely from Sydney on a fixed price, with weekly demos and code in your repository from day one. We host in Australian regions by default, in Melbourne where you want data kept in Victoria. See our custom app development service, or how remote delivery works across Australia.
Frequently asked questions
Do you have a Melbourne office?
No. We're in Sydney and work with Melbourne organisations remotely, travelling for discovery workshops, design reviews and user testing. Melbourne is on the same time zone as Sydney all year, including daylight saving, so working hours line up exactly.
Are you on the Victorian eServices register?
Not at the time of writing. The register is open for applications at any time. If you're a Victorian agency, check a supplier's register status before engaging them for ICT services the register covers.
Can our data stay in Victoria?
Yes, for storage and processing on AWS (ap-southeast-4), Azure Australia Southeast or Google Cloud australia-southeast2. AI model availability can differ between the Melbourne and Sydney regions and changes often, so we check the specific model during discovery.
Does the PDP Act apply to private companies?
Generally not directly. It applies to Victorian public sector organisations. But a private company contracted to a Victorian agency can be bound to the Information Privacy Principles through its contract, so suppliers should expect privacy and security clauses that mirror the Act.
Should we hire a Melbourne software development company instead?
If you want a team that can drop into your office any day of the week, a Melbourne firm has a real advantage. If most of the value is in the build and the in-person moments are a few workshops and testing sessions, a remote team on the same time zone works well. Compare how each firm tests, prices and hands over code, and ask for the week-by-week plan.
Do you do Microsoft AI consulting, such as Copilot and Azure?
We build on Microsoft Azure, including Azure-hosted models in the Australia Southeast region where the model is available, and we help organisations decide whether Microsoft 365 Copilot is enough before building anything custom. We don't hold a Microsoft partner designation, so if a program requires one, you'll need a partner for that part.
What do senior developers cost in Melbourne?
Re:Sourced's 2026 guide puts senior software contractor day rates in Melbourne at $750 to $1,050 (AUD, ex GST), slightly below Sydney. Agency rates build on that with design, testing and project management.
Sources
- Access Digital Marketplace , Buying for Victoria
- eServices register , Buying for Victoria
- Information Privacy Principles short guide , Office of the Victorian Information Commissioner
- Victorian Protective Data Security Standards V2.0 , Office of the Victorian Information Commissioner
- Agency reporting obligations , Office of the Victorian Information Commissioner
- Health Records Act , Department of Health, Victoria
- Now open: AWS Asia Pacific (Melbourne) Region in Australia , Amazon Web Services
- Tech contractor day rates in Australia: the 2026 guide , Re:Sourced