Your data never leaves the EU
Every byte is stored and processed within the EU/EEA. Database, authentication and file storage in Finland; AI inference in the EU data zone and Belgium; transactional email via Ireland. No personal data crosses the union's border — it's built into the architecture, not a setting that can be changed.
- Hetzner · Finland (EU)
- Azure OpenAI · EU data zone
- Vertex AI · Belgium (EU)
- Resend · Ireland (EU)
All sub-processors process data within the EU/EEA.
- AES-256 encrypted at rest
- TLS in transit
- Backups within the EU
Data storage
Student data is stored on Gradr's self-hosted infrastructure at Hetzner in Finland (EU): database, authentication, and file storage. Data is encrypted with AES-256 at rest and TLS in transit; backups are stored within the EU. Hetzner is a European company — a deliberate choice, so that student data is not exposed to US legislation such as the CLOUD Act.
- No model training on student data
- AI inference within the EU only
- Binding under Art. 28(3)
AI processing — EU only
AI processing happens exclusively within the EU: Microsoft Azure OpenAI (EU data zone) and Google Vertex AI (Belgium). No personal data is transferred outside the EU/EEA. Under the data processing agreement (Annex 1, point 9), student and user data may not be used to train, develop, or improve AI models, and our providers' terms align with this.
How student data is handled, point by point
The summary above is enough for most. Here are the specifications for those reviewing more closely — and the full agreements are one click away.
Data minimisation and pseudonymisation
Generating feedback only requires the question and the student's answer. Name, email, and class are used solely to match answers to the right student and to run secure exams. Names are separated from answers and pseudonymised at first read. Two optional features — PDF parsing and Insight — can mean that names pass through Google Vertex AI (within the EU); both are optional and can be disabled.
Data Gradr does not process
Gradr does not process personal identity numbers (personnummer), no special-category data under GDPR Article 9, and no secondary identifiers such as home address, phone number, date of birth, gender, photo, audio, or video.
The teacher decides — not the AI
The AI drafts formative feedback suggestions based on the teacher's own instructions and criteria. The teacher reviews and approves every suggestion; nothing reaches a student without the teacher's action. The AI never sets grades, points, or summative assessments — multiple-choice questions are scored deterministically against the teacher's answer key. No automated decision-making within the meaning of GDPR Article 22 therefore takes place.
Sub-processors
Gradr uses five sub-processors, all processing within the EU:
| Sub-processor | Data location | Purpose |
|---|---|---|
| Hetzner | Finland (EU) | Self-hosted core infrastructure: database, authentication, file storage |
| Microsoft Azure OpenAI | EU data zone | AI models for formative feedback |
| Google Vertex AI | Belgium (EU) | AI inference and PDF parsing |
| Resend | Ireland (EU) | Transactional email (no student answers) |
| Customer.io | Belgium (EU) | Teacher communication and activity (no student data) |
Agreements and DPIA
The school organiser (huvudman) – the school, its administration or its group – is the data controller; Gradr is the data processor. Gradr provides and signs a data processing agreement (GDPR Art. 28(3)) with every school customer, and provides documentation to support the organiser's data protection impact assessment (DPIA).
Your rights
Data subjects can exercise their rights under the GDPR by contacting us. Complaints can be lodged with the Swedish Authority for Privacy Protection (IMY).
Frequently asked questions
Student data is stored on Gradr's self-hosted infrastructure at Hetzner in Finland (EU), encrypted with AES-256 at rest and TLS in transit, with backups inside the EU. Hetzner is a European company, so student data is not exposed to US legislation such as the CLOUD Act.
That is why schools choose Gradr over general AI tools that are not built to process student data on a school's instructions.
Try Gradr with your own class!
Book a short demo – we'll show you how it works, you decide if it fits.
Book a demo