Edsthetic trust
The third parties Edsthetic engages to deliver Writeiq and Allocateiq: what each one does, what data it handles, and where it processes it. School data at rest and model processing are performed in Australia. This list implements Section 10 of the Edsthetic Data Processing Agreement.
Two facts sit above the list, because they are what a school most needs to know:
ap-southeast-2). Backups are encrypted, held in Sydney, and never replicated outside Australia.ap-southeast-2) and Melbourne (ap-southeast-4). Where Australian capacity is unavailable a request queues or degrades; it is not rerouted to a non-Australian region without an explicit, recorded school authorisation.| Sub-processor | Purpose | Data handled | Location & certifications |
|---|---|---|---|
| Supabase | Database, authentication, edge functions, file storage | All School data at rest | AWS Sydney (ap-southeast-2) · SOC 2 Type II |
| Amazon Bedrock (AWS) | AI assessment support (criterion-level analysis and feedback for teacher review) and handwriting transcription | Student writing text and, for the optional Vision feature, page images, processed transiently, not retained, and not used to train models | Australia - Sydney (ap-southeast-2) / Melbourne (ap-southeast-4) · SOC 2 Type II, ISO/IEC 27001, IRAP · AWS DPA |
| Microsoft Azure AI Document Intelligence | Handwriting layout extraction for the optional Vision feature (lines, words, position, confidence, for teacher review before marking); produces no scores or feedback | Scanned page images only, never typed submissions, processed transiently, not retained, not used to train models | Australia East · SOC 2 Type II, ISO/IEC 27001, IRAP · Microsoft Online Services DPA |
| AWS SES | Transactional email (invitations, notifications, report delivery) | Recipient address and message body; no submission content | AWS Sydney (ap-southeast-2) · SOC 2 Type II, ISO/IEC 27001 |
| Cloudflare | Edge protection: web application firewall, DDoS mitigation, TLS termination | No stored School data; inspects request metadata at the edge | Global edge network (Sydney point of presence) · SOC 2 Type II, ISO/IEC 27001 |
| Netlify | Static hosting and serverless functions (marketing site and same-origin API edge functions) | No stored School data; standard access logs | Global edge · SOC 2 Type II |
| Sentry | Error monitoring | Error traces scrubbed of credentials, licence keys and identifiers; no student content or student-identifying information | United States · SOC 2 Type II |
| PostHog | Product analytics (admin panel navigation only) | Anonymous page-view and tab-navigation events; no student content, no names | United States · SOC 2 Type II |
| Stripe (only when billing is active) | Payment processing for paid deployments | Billing-contact and payment details only; no student, staff or school content; not used in pilot or unbilled deployments | United States · PCI DSS Level 1, SOC 2 Type II |
School data at rest and model processing are in Australia. The processing that occurs outside Australia is limited to operational and (when active) billing services that do not handle student submission content: Netlify (hosting/edge), Sentry and PostHog (operational logs and anonymous analytics), and Stripe (payment details only, and only for billed deployments). Edsthetic takes reasonable steps to ensure overseas recipients handle personal information consistently with the Australian Privacy Principles, including through data-processing terms with each sub-processor. This supports a school's obligations under APP 8 (cross-border disclosure).
Edsthetic gives schools at least 30 days' notice before adding or replacing a sub-processor that processes personal information. A school may object on reasonable data-protection grounds within the notice period; the parties will work in good faith to resolve it, and failing that the school may terminate the affected part of the service as set out in the Services Agreement. Each sub-processor is bound by a written agreement imposing data-protection, confidentiality and security obligations no less protective than those in the DPA, and Edsthetic remains responsible to the school for its sub-processors.
Questions about a sub-processor, or want notice of changes? Email privacy@edsthetic.com.au.
Related documents: Security & Privacy · Data Deletion Policy · Incident Response Plan · Privacy Policy · Data Processing Agreement (PDF)