Data protection · Student data stays within the EU
Made in Sweden.
Kept in Europe.
Gradr runs on its own servers at European companies, and student data never leaves the EU. If you want to go all the way, we run the AI fully in Europe as well. Then there is not a single American company in the chain.
The whole chain, openly disclosed
| Function | Provider and location | Company |
|---|---|---|
| Hosting, database and files | Hetzner, Helsinki (Finland) | German company. |
| Backups, dictation and AI features in EU-sovereign mode | Scaleway, Paris (France) | French company. |
| AI features, standard | Microsoft, data in Sweden and processing within the EU | American parent company. |
We run the platform ourselves on the servers in Finland instead of buying a ready-made American cloud service. It costs more. We do it anyway.
Full EU sovereignty, when you want it
By default the AI runs on Microsoft. The data stays in the EU, but Microsoft has an American parent company, and municipalities assess that differently. That is why the choice is yours. If you turn on EU-sovereign mode, all AI runs on the French company Scaleway, and the whole chain is European.
GradrHetznerMicrosoftScaleway- HetznerFinland (EU)
- MicrosoftSweden (EU)
- ScalewayFrance (EU)
The teacher decides
Gradr helps the teacher produce the feedback they rarely have time to write themselves, so that the student knows what the next step is. The AI makes suggestions based on the teacher’s own instructions, and the teacher approves them before the student sees anything. The AI never sets grades. Grading is the exercise of public authority and is done by the teacher.
The AI only gets what it needs
When the AI suggests feedback, it receives the assignment, the teacher’s instructions and the student’s answer, but not who the student is. Nothing is used to train AI models, neither by us nor by the AI providers.
The school’s data. The school’s decisions.
The school organiser is the data controller and decides over its data. We sign a data processing agreement with every school and give your data protection officer the material for a DPIA from day one.
For data protection officers: the contracting parties, retention periods and the full DPIA material are in the privacy policy, or via privacy@gradr.se. Complaints can be lodged with IMY, the Swedish Authority for Privacy Protection.
Frequently asked questions
Is Gradr EU-sovereign?
Yes, when you choose it. Student data always stays in the EU, with hosting and storage on Hetzner (Germany) and Scaleway (France). With EU-sovereign mode, the AI also runs on Scaleway, with no American companies in the chain.
Where is student data stored in Gradr?
On Gradr’s own servers at Hetzner in Helsinki, Finland. The backups are kept at Scaleway in Paris. Everything stays within the EU.
Which systems are safe to use in schools?
Look at five things: that the provider signs a data processing agreement, that all data stays in the EU, that you know which companies are involved and where they are based, that student data is not used to train AI, and that the teacher sets the grades. Gradr meets all five.
Can teachers use ChatGPT to give feedback on student texts?
Not if the school has no agreement with the service. Student texts are personal data, and without an agreement the school does not know where they end up or what they are used for.