Sub-processors & Data Locations

The third-party services that process personal data on Tutorio's behalf, where they are based and what they do for us.

Effective 27 September 2026 Version 1 3 min read [email protected]
Version history

At a glance

The short version. The full policy below is what applies.

  • Personal data and backups are stored in the UK; a small number of providers process data in the US under UK transfer safeguards.
  • Every sub-processor is bound by a written contract with UK GDPR Article 28 terms.
  • AI providers receive only the content of the request and may not train on it.
  • Organisations get 30 days' notice of any new sub-processor and may object.

Tutorio uses a small number of trusted third parties to host and run the Service. This page lists them, where they process data and what they do for us. It forms part of our Privacy Policy and our Schools & Organisations Agreement. Organisations that have registered for notifications receive at least 30 days' notice before a new sub-processor is added.

Infrastructure and hosting

ProviderPurposeLocationTransfer safeguard
Amazon Web ServicesApplication hosting, serverless functions, object storage, scheduled jobsUnited Kingdom (London)Data stays in the UK; AWS DPA
MongoDB AtlasPrimary database and its backupsUnited KingdomData stays in the UK; MongoDB DPA
CloudflareContent delivery, DDoS protection, storage of the app's own static assets, widget renderingGlobal edge network; static app assets in EU (no customer data stored)UK IDTA / Addendum; Cloudflare DPA
Kubernetes-hosted services (UK data centre)Websocket and real-time live lesson services, geocodingUnited KingdomData stays in UK

Communications

ProviderPurposeLocationTransfer safeguard
Amazon SESTransactional email (receipts, invitations, reminders, security notices)United Kingdom (London)Data stays in the UK; AWS DPA
SMS gatewayClass invitation and reminder text messages where a phone number is providedUnited KingdomUK provider
Google Firebase Cloud MessagingPush notifications to Android and web devicesUnited States / globalUK IDTA Addendum; Google Cloud DPA
Apple Push Notification servicePush notifications and Live Activities on iOSUnited States / globalApple developer terms; token-only data

Identity and payments

ProviderPurposeLocationTransfer safeguard
Apple (Sign in with Apple, App Store)Optional sign-in; app distribution and in-app purchasesUnited States / globalApple terms; UK adequacy framework where applicable
Google (Sign in with Google, Google Play)Optional sign-in; app distribution and in-app purchasesUnited States / globalGoogle DPA; UK IDTA Addendum
Payment processor (web checkout)Card payments for web purchases; we never hold full card numbersEU / United StatesPCI DSS Level 1; UK IDTA Addendum

AI providers

ProviderPurposeLocationTransfer safeguard
AnthropicCourse drafting, marking against mark schemes, feedback and Rio conversationsUnited States (EU/UK routing where available)Commercial terms with zero data retention option; no training on customer data; UK IDTA Addendum
Google (Gemini API)Generating course cover images and icons from a tutor's text prompt; no learner data is sentUnited States / globalGoogle Cloud DPA; no training on API content; UK IDTA Addendum

Only the content needed for the request is sent (for example, a written answer plus the mark scheme). Learner names and contact details are not included unless the learner types them. Organisations may ask for AI features to be disabled. See the AI Transparency Statement.

Operations and support

ProviderPurposeLocationTransfer safeguard
GitHubSource control and CI; no production personal dataUnited StatesGitHub DPA
Error and performance monitoringCrash and performance diagnostics, with personal data scrubbedEUProvider DPA
Email helpdeskSupport correspondenceEU / United KingdomProvider DPA
Google AdSenseAdvertising on public marketing pages only, subject to cookie consentUnited States / globalGoogle Ads DPA; UK IDTA Addendum

Our commitments

  • Every sub-processor is bound by a written contract containing the obligations required by Article 28 of the UK GDPR.
  • We assess each provider's security before onboarding and review it periodically.
  • Where data leaves the UK we rely on adequacy regulations or the UK International Data Transfer Agreement or Addendum, supplemented by encryption and data minimisation.
  • We remain responsible to you and to organisations for our sub-processors' performance.

Change notifications

Organisations can subscribe to sub-processor change notices by emailing [email protected]. Changes are also recorded in the version history below.

Version history

Every published version of this document, newest first. Material changes are announced before they take effect.

  1. Version 1Current

    Initial publication.

    Effective from 27 September 2026

Questions about this policy?

Email [email protected] and a person will reply. For anything urgent about a child's safety, contact [email protected] or the emergency services.

Related policies

Privacy Policy

What personal data Tutorio collects from learners, tutors, parents and organisations, why we collect it, who sees it and how long we keep it.

Schools & Organisations Agreement

How Tutorio works with schools, colleges, councils and tutoring agencies, including our data processing commitments.

AI Transparency Statement

Where Tutorio uses artificial intelligence - course drafting, marking and Rio - what data it sees, its limits and the human checks around it.

Printed from https://tutorio.app/policies/subprocessors · Version 1 · Tutorio Ltd, company no. 14962372