Your data never leaves the EU
Every byte is stored and processed within the EU/EEA. Database, authentication and file storage in Finland; AI inference in the EU data zone and Belgium; backups in France. No personal data crosses the union's border — it's built into the architecture, not a setting that can be changed.
- Hetzner · Finland (EU)
- Azure OpenAI · Sweden (EU data zone)
- Vertex AI · Belgium (EU)
- Scaleway · France (EU)
All sub-processors process data within the EU/EEA.
- Database and backups encrypted at rest
- TLS in transit
- Backups within the EU
Data storage
Student data is stored on Gradr's self-hosted infrastructure at Hetzner in Finland (EU): database, authentication, and file storage. The database and the backups are encrypted at rest — the database volume with LUKS/AES-256 and the backups before they leave the server — and all communication uses TLS. The backups are also mirrored nightly to an external storage provider within the EU. Hetzner is a European company — a deliberate choice, so that student data is not exposed to US legislation such as the CLOUD Act.
- No model training on student data
- AI inference within the EU only
- Binding under Art. 28(3)
AI processing — EU only
AI processing happens exclusively within the EU: Microsoft Azure OpenAI (EU data zone, data at rest in Sweden) and Google Vertex AI (Belgium). No personal data is transferred outside the EU/EEA. Neither provider uses prompts or outputs to train or fine-tune AI models — Microsoft does not process customer data for training, and Google's terms do not permit it without explicit instruction.
How student data is handled, point by point
The summary above is enough for most. Here are the specifications for those reviewing more closely.
Data minimisation
An AI call for feedback contains no identity fields for the student: name, email, class, school, year group and internal user number are separated before the answer is sent for AI inference. What is sent is the question with the teacher's marking criteria and accompanying material, plus the student's answer. The student's answer is sent verbatim and can therefore contain information the student wrote themselves. The measure is data minimisation — the answer is sent without being replaced by any identifier at the provider.
Data Gradr does not process
The platform has no fields intended for personal identity numbers (personnummer) or for special-category data under GDPR Article 9, and Gradr does not ask for such data. Because students and teachers write in free text, such data can still occur unintentionally; there is no technical filtering that prevents it. The platform also has no fields for secondary identifiers such as home address, phone number, date of birth, gender, photo, audio, or video.
The teacher decides — not the AI
The AI drafts formative feedback suggestions based on the teacher's own instructions and criteria. The teacher reviews and approves every suggestion; nothing reaches a student without the teacher's action. The AI never sets grades, points, or summative assessments — multiple-choice questions are scored deterministically against the teacher's answer key. No automated decision-making within the meaning of GDPR Article 22 therefore takes place.
Sub-processors
Gradr uses four sub-processors, all processing within the EU:
| Sub-processor | Data location | Purpose |
|---|---|---|
| Hetzner | Finland (EU) | All rented infrastructure for running the platform: servers, object storage and networking |
| Microsoft Azure OpenAI | Sweden (EU data zone) | AI inference in the EU data zone: formative feedback, exam parsing, name extraction |
| Google Vertex AI | Belgium (EU) | AI inference: assessment, insights, language review, parsing and text-to-speech |
| Scaleway | France (EU) | External cold storage of database backups |
Agreements and DPIA
The school organiser (huvudman) – the school, its administration or its group – is the data controller; Gradr is the data processor. Gradr provides and signs a data processing agreement (GDPR Art. 28(3)) with every school customer, and provides documentation to support the organiser's data protection impact assessment (DPIA).
Your rights
Data subjects can exercise their rights under the GDPR by contacting us. Complaints can be lodged with the Swedish Authority for Privacy Protection (IMY).
Retention periods
This is how long the data is kept in the platform. Beyond that, processing runs for the term of the agreement.
- Logs of user activity
- 6 calendar months
- Operational logs
- 7 days
- Recovery window for backups
- 30 days
Logs are purged by a daily job with a one-day safety margin. As a consequence, the right to review logs in hindsight is limited to six months back in time.
Frequently asked questions
Student data is stored on Gradr's self-hosted infrastructure at Hetzner in Finland (EU). The database and the backups are encrypted at rest, all communication uses TLS, and the backups are mirrored nightly to an external storage provider within the EU. Hetzner is a European company, so student data is not exposed to US legislation such as the CLOUD Act.
That is why schools choose Gradr over general AI tools that are not built to process student data on a school's instructions.
Try Gradr with your own class!
Book a short demo – we'll show you how it works, you decide if it fits.
Book a demo