Sub-processors
Aulia acts as a processor on behalf of each school. To provide the service we rely on the providers below, which are our sub-processors under Article 28 GDPR. This page is the current list referred to in the data processing agreement each school signs.
Last reviewed 2026-08-23
How changes work
Adding or replacing a sub-processor is notified to the school by e-mail at least 15 days in advance, and the school may object during that period. Removing one is notified without a waiting period, because no new party gains access to the data.
| Provider | Purpose | Data reached | Processing location | Transfer safeguard |
|---|---|---|---|---|
| Vercel Inc.United States | Application hosting and execution of the server functions | All categories, in transit through the server functions; technical identifiers in the logs | European Union (Frankfurt). Software build processes run in the United States. | DPF + SCCs |
| Neon, LLCa Databricks, Inc. companyUnited States | Managed database: all structured platform data | Identifying and contact data of pupils, families and staff; daily record; assessment; consent forms | European Union (Frankfurt) | DPF + SCCs |
| Cloudflare, Inc.ImagesUnited States | Photo storage and delivery | Images of pupils and staff | Cloudflare global network. This service offers no EU residency guarantee; images are stored privately and served through temporary signed links. | DPF + SCCs |
| Cloudflare, Inc.R2United States | Storage of documents and file attachments | School documents, message attachments and identity documents of authorised persons | European Union (EU-jurisdiction bucket: storage and processing guaranteed within the EU) | DPF + SCCs |
| Cloudflare, Inc.DNS and inbound mailUnited States | Domain DNS and inbound mail routing | Sender, recipient and content of messages addressed to the domain (transit) | Global network (transit) | DPF + SCCs |
| Amazon Web Services EMEA SARLTranscribeLuxembourg | Transcription of teaching staff voice notes | Teaching staff voice; dictation may name pupils. Audio is not stored — only the transcript is kept. | European Union (Frankfurt) | DPF + SCCs |
| Anthropic, PBCUnited States | Language models: structuring voice dictation and drafting reports for teachers | Dictation transcript and the class roster of pupil names; first name and staff notes. No contact details, no medical fields. | United States | DPF + SCCs; contractual commitment not to train models on this data |
| Resend, Inc.United States | Transactional e-mail: access codes and platform notices | E-mail addresses, names and the content of notices | United States | DPF + SCCs |
| Functional Software, Inc. (Sentry)United States | Application error monitoring | User and school identifiers, technical device data and error traces | European Union (EU data region, Frankfurt). Operational metadata in the United States. | DPF + SCCs |
| Google Ireland LimitedDrive backup (optional)Ireland | Backup of photographs to the school's own Google Drive. Optional feature, off by default, switched on expressly by the school. | Images of pupils | Whatever the school has configured in its own Google Workspace | DPF + the school's own data processing agreement with Google |
Planned, not yet in use
Providers we may add. They are published before they process anything, so a school sees them when it signs rather than in a change notice later. A provider listed here may never be used.
| Provider | Purpose | Status |
|---|---|---|
| OpenAI, L.L.C. | Language models, as an alternative or complement for the assisted features | Planned, not in use. |
| DeepSeek | Lower-cost language models for the same features | Assessed and blocked. China has no adequacy decision: use would require standard contractual clauses and a transfer impact assessment. It will not be activated for school data without a favourable legal opinion. |
| Google Workspace | Corporate e-mail; will receive inbound mail once the MX records change | Planned, not yet purchased. |
Assessed and excluded
These services are used but are not sub-processors, because they do not process personal data on Aulia’s behalf. They are listed so the assessment is visible rather than assumed.
- Google FCM · Apple · Mozilla — Push notifications: content is end-to-end encrypted, so the provider sees only a pseudonymous identifier. Transit only.
- Telegram — Internal alert channel for the Aulia team. It receives only an event headline and a link; no personal data.
- Google Fonts — Fonts are downloaded at build time and served from our own hosting: the browser never contacts Google.
Questions
Data protection queries, including objections to a new sub-processor, go to rgpd@auliafamily.com. Families should contact their school, which is the controller of the data.