Australian storage, approved student AI processing and encrypted backups. Providers are international companies; we review
their support access and subprocessor arrangements, and update this page when they change.
Student records and work
Storage, approved AI processing and backups in Australia.
Student records and work: providers, data and locations. Expand details for access and safeguards.
Provider
Data
Location
SupabaseDatabase, accounts and file storage
DataAccounts, school records and student workDetails for Supabase: Database, accounts and file storage
Information handled
Student and staff accounts, school and class records, writing, assessment results, uploaded media and service logs.
Student data
Yes — holds student records and work.
Location
Production storage in Australia.
Safeguards
School and role-based access, restricted administration and reviewed provider support access. Also supports our business contact systems.
Location Australia
Amazon Bedrock (AWS)Student writing and learning AI
DataWork and prompts submitted for marking and feedbackDetails for Amazon Bedrock (AWS): Student writing and learning AI
Information handled
The writing, prompts and task context needed for approved marking and feedback.
Student data
Yes — processes student work for the requested learning task.
Location
Approved models through the Australia-only Bedrock profile (Sydney and Melbourne).
Safeguards
School AI choice and approved models only. The AWS AI services opt-out applies to our account. Provider training, fine-tuning and product improvement with student data are prohibited under these arrangements.
Location Australia
Microsoft AzureStudent writing and learning AI
DataWork and prompts submitted for feedbackDetails for Microsoft Azure: Student writing and learning AI
Information handled
The writing, handwriting, prompts and task context needed for approved analysis and feedback, including when it answers in place of Amazon Bedrock.
Student data
Yes — processes student work for the requested learning task.
Location
Approved student AI deployments within the documented Australian processing boundary.
Safeguards
School AI choice and restricted providers/deployments. Provider training, fine-tuning and product improvement with student data are prohibited under these arrangements.
Location Australia
Amazon Web Services (AWS)Backups, recovery and transactional email
DataEncrypted backups; adult email addresses, messages and delivery dataDetails for Amazon Web Services (AWS): Backups, recovery and transactional email
Information handled
Encrypted database and file backups, recovery logs, and Amazon SES transactional email: adult recipient addresses, operational message content and delivery or suppression metadata.
Student data
Student information is included in encrypted backups. Transactional email is limited to school staff, platform staff and adult business contacts; student writing, assessment results and generated feedback are excluded.
Location
Backup storage and configured Amazon SES resources are in Sydney, Australia (ap-southeast-2). Email delivery networks and recipients’ mailbox providers may process messages outside Australia.
Safeguards
Encrypted backups with restricted access and separately authorised recovery. Email is limited to operational messages, with data minimisation and delivery monitoring; student/parent recipients are excluded, and marketing email runs separately (Teacher & business services, below). Neither backups nor email is an AI processing route; AI processing on AWS uses Amazon Bedrock, listed above.
Location Australia
School-managed sign-in
Students and staff can use school Google or Microsoft accounts, where enabled.
School-managed sign-in: providers, data and locations. Expand details for access and safeguards.
Provider
Data
Location
Google WorkspaceSchool account sign-in
DataStudent and staff sign-in identityDetails for Google Workspace: School account sign-in
Information handled
Account identity and authentication information needed to sign in, such as name, email address and account identifier.
Student data
Includes students who sign in with their school Google account. Student writing and assessment results are not sent as part of sign-in.
Location
Depends on the school’s Google service and applicable provider terms. School data-region settings do not guarantee Australian-only authentication processing.
Safeguards
School-managed accounts and sign-in permissions. This sign-in service does not authorise Google AI to process classroom content.
Location School/provider arrangements
Microsoft Entra IDSchool account sign-in
DataStudent and staff sign-in identityDetails for Microsoft Entra ID: School account sign-in
Information handled
Account identity and authentication information needed to sign in, such as name, email address and account identifier.
Student data
Includes students who sign in with their school Microsoft account. Student writing and assessment results are not sent as part of sign-in.
Location
Depends on the school’s Microsoft tenant and applicable provider terms. This is separate from Writing Boost’s Australian student storage and AI processing.
Safeguards
School-managed accounts and sign-in permissions. Separate from Writing Boost’s business email and calendar services.
Location School/provider arrangements
Teacher & business services
Separate from student assessment. Some services operate overseas.
Teacher & business services: providers, data and locations. Expand details for access and safeguards.
Provider
Data
Location
Microsoft AzureTeacher-generated stimulus images
DataImage promptsDetails for Microsoft Azure: Teacher-generated stimulus images
Information handled
Teacher-entered image prompts and the prepared generation prompt, including personal information a teacher may enter.
Location
Configured in East US 2, United States, using Global Standard. Processing can also occur outside the US.
Safeguards
Separate from student writing, marking, handwriting and feedback. Teachers should avoid identifiable or sensitive information and review images before classroom use.
Location US & other countries
Microsoft 365 / EntraStaff identity, business email and calendars
DataStaff accounts, business email and calendarsDetails for Microsoft 365 / Entra: Staff identity, business email and calendars
Information handled
Staff identity and business contact correspondence, meeting and calendar information.
Location
Contracted Microsoft tenant; external email delivery is global. This is separate from the Australian student AI boundary.
Safeguards
Restricted account and mailbox access. Business communications are kept separate from classroom records.
Location Microsoft tenant; global email
NetlifyPlatform frontend hosting
DataPublic app files and visitor metadataDetails for Netlify: Platform frontend hosting
Information handled
Public application files and visitor network/request metadata.
Location
Global website delivery, including outside Australia.
Safeguards
Static frontend delivery; application records remain in the platform data service. No server-side student-data processing under this hosting scope.
Location Global
Amazon Web Services (AWS)Marketing email
DataSubscribers’ email addresses, emails and delivery dataDetails for Amazon Web Services (AWS): Marketing email
Information handled
Email addresses of people who join our mailing list or give their email for the student videos or our free course, the emails we send them, and delivery, bounce and unsubscribe metadata.
Location
Amazon SES resources are in Sydney, Australia (ap-southeast-2), on a sending domain of their own. Email delivery networks and recipients’ mailbox providers may process messages outside Australia.
Safeguards
Sent only to people who subscribed, with an unsubscribe link in every email. Never sent to student accounts, and no student writing, results or feedback.
Location Australia
CloudflareWebsite delivery, DNS and security checks
DataWebsite traffic and browser/device signalsDetails for Cloudflare: Website delivery, DNS and security checks
Information handled
Visitor network and request metadata, public website responses, and browser/device signals for applicable anti-bot checks.
Location
Global network, including outside Australia.
Safeguards
Restricted edge caching; authenticated application responses must not be cached. Forms may use Turnstile to check for automated submissions.
Location Global
GoogleAdmin sign-in and public assets
DataAdmin identity, browser requests and school domainsDetails for Google: Admin sign-in and public assets
Information handled
Administrative sign-in identity, browser request metadata and school website domains used for public icon lookups.
Location
Global services, including outside Australia.
Safeguards
Limited administrative and public-asset use, with data and referrer minimisation. This is not approval to send classroom content to Google AI.
Location Global
XeroAccounting
DataBusiness contacts, quotes and invoicesDetails for Xero: Accounting
Information handled
Business contact and organisation details, quotes and invoices.
Location
Xero uses overseas hosting and international service providers for accounting data.
Safeguards
Restricted accounting access and business information only. Accounting data is not authorised for reuse in AI services.
