VANTAGELawful basis for processing
Each sub-processor processes personal information only on Vantage’s documented instructions, as a processor under the Data Processing Agreement — not for its own purposes. Vantage’s basis for the underlying handling is delivery of the contracted service to the school (the data controller) under the School Subscription Agreement and the Australian Privacy Principles. For overseas recipients, Vantage applies Australian Privacy Principle 8 safeguards (contractual controls, due diligence, data minimisation, and security requirements) before disclosure. No sub-processor is authorised to use School Data for its own marketing, advertising, or AI/ML training. The primary student-record database is hosted in Australia (Sydney).
Current sub-processors
| Sub-processor | Purpose | Data types | Country / region | Contact |
|---|---|---|---|---|
| Supabase | Primary managed database, authentication, and file storage | Account/identity, School Data, contact details, technical/diagnostic | Australia (Sydney); AES-256 at rest, TLS in transit | supabase.com/legal/dpa |
| Vercel | Application hosting, CDN, managed TLS, edge WAF/DDoS, deployments | Account/identity (in transit), technical/diagnostic (request metadata, logs) | United States-headquartered; Vantage’s application compute runs in the Sydney region, with a global edge network for static assets and request routing | vercel.com/legal/dpa |
| Sentry | Application error and performance monitoring | Technical/diagnostic (error traces); personal information minimised by scrubbing | United States or European Union | sentry.io/legal/dpa |
| Upstash | Serverless Redis for rate limiting (optional) | Technical/diagnostic (rate-limit keys, limited identifiers) | Overseas-capable (provider region) | upstash.com/trust |
| Resend | Transactional email (magic links, notifications, alerts) | Contact (recipient email), message content, delivery metadata | United States | resend.com/legal/dpa |
| Twilio | SMS delivery — currently disabled (no SMS sent in production) | Contact (phone), message content, delivery metadata (when enabled) | United States | twilio.com/legal/data-protection-addendum |
| web-push / VAPID | Browser/PWA push notifications via the recipient’s browser push service | Push subscription endpoint and keys; minimal payload (no sensitive School Data) | Recipient browser-vendor infrastructure (global) | web-push (open library) |
| Edval (LISS) | Inbound timetable/class/period and student-staff sync, using the school’s own LISS credentials (encrypted at rest) | School Data received from the school’s timetable system | Per Edval (school-supplied; data flows into Vantage) | edval.education |
| Amazon Web Services (SES) | Transactional email — not currently enabled (an alternative email path exists in the product; production email uses Resend) | Contact (recipient email), message content, delivery metadata (only if enabled) | Australia (Sydney) by default | aws.amazon.com/compliance/data-privacy |
| Slack | Optional internal operations alerting — not currently enabled (only active if Vantage configures an internal alert webhook) | Technical/diagnostic (job/feed status, error text) plus school name; no student, parent, or staff record data | United States | slack.com/trust/privacy |
| Google Analytics | Public website analytics for vantageschool.com.au pages only — not loaded inside the authenticated app |
Website usage analytics such as page views, referrer, device/browser data, and approximate location; no School Data | Google global infrastructure; overseas-capable | Google data processing terms |
Where data lives
These entries are consistent with the Australian-residency statements on our Security page: the primary student-record database and the application compute both run in the Sydney region, while some providers above are headquartered in the United States and Vercel’s global edge network is used only to deliver static assets and route requests — the country column shows where each provider may process the limited data types listed, not where School Data is stored.
Material new or replacement sub-processors are notified to school customers in advance, with a reasonable opportunity to object on documented privacy or security grounds. Questions: admin@vantageschool.com.au.