Trust Centre
Schools and municipalities are the data controllers for the personal data of their pupils and teachers. Datorium is their data processor under a Data Processing Agreement. Datorium stores personal data in the European Union; where a provider may process data outside the EEA, the table below says so. Personal data is never used to train AI models.
Last reviewed: 27 September 2026.
Data Processing Agreement for schools and municipalities
Schools and municipalities sign our Data Processing Agreement with SIA “Riga International Tuition Centre”, the Latvian company that operates Datorium.AI. Request it by email and we will send it to your data protection or procurement contact.
Hosting and processing locations
| Service or data | Provider | Location |
|---|---|---|
| The application, database, file storage and search index | Amazon Web Services | EU (Frankfurt, Germany) |
| Web applicationThe pages you load in your browser | Vercel | EU (Frankfurt, Germany); content delivered through a global network |
How we use AI
- We do not train AI models. Pupils’ messages and answers are processed by Microsoft’s Azure OpenAI Service, which does not use them to train its models.
- That service stores data in Germany; AI processing may occur outside the EEA under Microsoft’s standard contractual clauses.
- No names, email addresses or account identifiers reach the models.
- A pupil’s message or answer may itself contain personal information that the pupil entered.
- A teacher reviews automatically assessed worksheet answers and can change the points, with the reason recorded. Teachers see every pupil’s chat transcript and can close an assignment at any time.
- Pupils are told in the product that replies are AI generated.
- The model receives the lesson content and, where a school uses chat or worksheet assignments, the pupil’s chat messages or answers, so that the tutor can reply and the work can be assessed.
- We do not ask for personal data in prompts and advise against entering it.
Technical and organisational security measures
- Data encrypted in transit using HTTPS/TLS
- Sign-in sessions use protected cookies that browsers send only over encrypted connections
- Passwords are stored only as salted hashes, never in clear text
- In the product, a pupil’s chat transcripts and results are shown only to that pupil and to the teachers of their class
- Analytics and marketing tools receive data only with your cookie consent, and never from pupil accounts
- The live service and testing run as separate environments
Our infrastructure and AI providers, including Amazon Web Services and Microsoft Azure, hold ISO/IEC 27001, 27017 and 27018 certifications and SOC 2 reports for their services. These belong to the providers, not to Datorium. Further information for a security, legal or procurement review is available from hello@datorium.eu.
Sub-processors
The providers below process personal data when supporting the operation of Datorium.AI. Analytics and marketing providers are not part of the service a school or municipality purchases; they serve our own website and product analytics, receive data only where the user accepted those cookies, and receive nothing from pupil accounts.
| Provider | Purpose | Location |
|---|---|---|
| Amazon Web Services | application infrastructure, database, file storage and search index | EU (Germany) |
| Vercel | hosting of the web application: the pages you load, sign-in sessions and printable documents | EU (Germany) |
| Microsoft Azure OpenAI Service | generating educational content, and processing pupils’ chat messages and answers for tutoring and assessment | EU (Germany) for storage; AI processing may occur outside the EEA under Microsoft’s standard contractual clauses |
| OpenAI | generating illustrative images for teaching materials | May process data outside the EEA |
| Perplexity AI | finding sources and images for generated explanations | May process data outside the EEA |
| Stripe | payment processing; we do not store full card details | May process data outside the EEA |
| optional account sign-in when the user chooses it | May process data outside the EEA | |
| Microsoft | optional account sign-in when the user chooses it | May process data outside the EEA |
| e-Klase | sign-in for supported school accounts in Latvia | EU (Latvia) |
| eKool | sign-in for supported school accounts in Estonia | EU (Estonia) |
| Brevo | transactional and account email | EU |
| PostHog | product analytics, with your consent to analytics cookies | EU |
| Meta | marketing measurement, with your consent to marketing cookies | May process data outside the EEA |
Transfers outside the EEA take place under the safeguards set out in our Data Processing Agreement, which also lists each provider’s processing location and how we give notice of changes to this list.
Data protection and privacy
Information about how Datorium.AI processes personal data and how individuals may exercise their rights is available in our Privacy Policy. View Privacy Policy
Data protection questions from a school’s data protection officer or procurement team go to hello@datorium.eu with the subject “Data protection”.
Report a security vulnerability
Suspected security vulnerabilities should be reported privately to Datorium before public disclosure. Reports will be reviewed as soon as reasonably possible.