Trust Centre
Information for schools, municipalities and institutional customers about Datorium.AI’s hosting, subprocessors, AI service providers and security measures.
Last reviewed: 2 August 2026. This page is reviewed whenever material changes are made to our hosting, subprocessors, AI service providers or security arrangements.
Hosting and processing locations
| Data | Stored in | Location |
|---|---|---|
| Product & customer dataaccounts, lessons, generated content, billing | PostgreSQL on Amazon Web Services (AWS) | AWS eu-central-1, Frankfurt, Germany |
| Website and CMS contentPublic website content; no Datorium.AI customer content | MongoDB Atlas | AWS eu-north-1, Stockholm, Sweden |
| Files & media | Amazon S3 | AWS eu-central-1, Frankfurt, Germany |
Subprocessors
Primary customer data is hosted within the European Union. Selected service providers may process limited data when providing authentication, payments, email delivery or AI functionality. The third-party service providers below may process limited personal data when supporting the operation of Datorium.AI.
- Amazon Web Services (AWS) — application infrastructure, database hosting and file storage
- MongoDB Atlas — database hosting for public website and CMS content
- OpenAI — assistance with translation of website and CMS content
- Microsoft Azure OpenAI Service — processing user prompts and relevant context to generate educational content
- Stripe — payment processing; Datorium does not store full payment-card details
- Google — optional account authentication when selected by the user
- Microsoft — optional account authentication when selected by the user
- e-Klase — optional authentication for supported school accounts in Latvia
- eKool — optional authentication for supported school accounts in Estonia
- Brevo — transactional and account-related email delivery
Data protection and privacy
Information about how Datorium.AI processes personal data and how individuals may exercise their rights is available in our Privacy Policy. View Privacy Policy
When Datorium processes personal data on behalf of a school or municipality, the processing is governed by a Data Processing Agreement, available on request from hello@datorium.eu.
Technical and organisational security measures
- Data encrypted in transit using HTTPS/TLS
- Customer data encrypted at rest in the primary database and file-storage services
- Access to production and administrative systems restricted to authorised personnel according to operational responsibilities
- Selected infrastructure and AI service providers, including Amazon Web Services, Microsoft Azure and MongoDB Atlas, maintain recognised certifications and assurance reports such as ISO/IEC 27001 and SOC 2.
Selected infrastructure and AI service providers, including Amazon Web Services, Microsoft Azure and MongoDB Atlas, maintain recognised security certifications and independent assurance reports for services within their respective scopes. These include ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018 and SOC 2 reports. These certifications and reports apply to the providers and services within their respective certification scopes. Additional information required for an institutional security, legal or procurement review may be requested from hello@datorium.eu.
Report a security vulnerability
Suspected security vulnerabilities should be reported privately to Datorium before public disclosure. Reports will be reviewed as soon as reasonably possible.