Sub-processors
Aulia acts as a processor on behalf of each school. To provide the service we rely on the providers below, which are our sub-processors under Article 28 GDPR. This page is the current list referred to in the data processing agreement each school signs.
Last reviewed 2026-09-09
| Provider | Purpose | Processing location |
|---|---|---|
| Vercel Inc.United States | Application hosting and execution of the server functions | European Union (Frankfurt) |
| Neon, LLCa Databricks, Inc. companyUnited States | Managed platform database | European Union (Frankfurt) |
| Cloudflare, Inc.ImagesUnited States | Photo storage and delivery | Cloudflare global network (no EU residency guarantee; private images served through short-lived signed links) |
| Cloudflare, Inc.R2United States | Storage of documents and file attachments | European Union (EU jurisdiction) |
| Amazon Web Services EMEA SARLTranscribeLuxembourg | Transcription of teaching staff voice notes | European Union (Frankfurt) |
| Anthropic, PBCUnited States | Language models: voice dictation and report drafts for teachers | United States |
| Resend, Inc.United States | Transactional e-mail: access codes and platform notices | United States |
| Functional Software, Inc. (Sentry)United States | Application error monitoring | European Union (Frankfurt) |
| Google Cloud EMEA LimitedGoogle Workspace (company mailbox)Ireland | Aulia’s mailbox: inbound and outbound mail with schools and families | Google global infrastructure (no EU residency guarantee on the current plan) |
| Google Ireland LimitedDrive backup (optional)Ireland | Backup of photographs to the school's own Google Drive | Whatever the school has configured in its own Google Workspace |
International transfers arising from the provision of the service are covered, as applicable, by the EU-US Data Privacy Framework and/or by the Standard Contractual Clauses approved by the European Commission.
How changes work
Adding or replacing a sub-processor is notified to the school by e-mail at least 15 days in advance, and the school may object during that period. Removing one is notified without a waiting period, because no new party gains access to the data.
Questions
Data protection queries, including objections to a new sub-processor, go to rgpd@auliafamily.com. Families should contact their school, which is the controller of the data.