Where your data is kept
Student work may be personal information, so every service that stores or processes it runs in Australia. Before anything is sent for AI marking, students’ names, emails and IDs are replaced with a neutral label such as “Student 014”. The real names are kept in a separate table that only you can see, and are used only when you send results back to students.
| Service | Location | Notes |
|---|---|---|
| Database and sign-in (Supabase) | Sydney (ap-southeast-2) | Confirm the project region in the Supabase dashboard. |
| Student files (Amazon S3) | ap-southeast-2 | Private bucket, public access blocked, encrypted. |
| Handwriting/OCR (Amazon Textract) | ap-southeast-2 | |
| AI marking (Claude on Amazon Bedrock) | Not configured | Only the manual copy/paste bridge is available. |
| Web hosting (Vercel functions) | syd1 (vercel.json) |
- Original files are never changed. Marking uses a sanitised copy with document metadata removed.
- Student work is not used to train AI models (Amazon Bedrock does not use customer data for training).
- You can delete a submission, a whole class set, or just the names at any time. Deleting removes the files and every derived copy.
- Removing names is careful but not perfect: a name written on a page can only be masked in the recognised text, so check flagged items.