Technology & Security
Operation and data in the EU
Database, files and server functions are in Frankfurt — as a hard rule in the code that an automated test checks on every change. Individual services such as speech output work in the USA; they are named.
Varför#
Universities and companies have to prove where personal data is processed. A promise on a website only helps if it is in the code and is checked.
Så fungerar det#
- 1User data, exam results, certificates and payment data are in the database in Frankfurt.
- 2The application itself runs in an EU region; the region is in the configuration in the source code and applies to every deployment — including every future customer instance.
- 3An automated test fails as soon as someone removes the region, empties it or sets it to one outside the EU.
- 4Speech recognition (speaking instead of typing) runs in the EU and would rather refuse service than fall back to a provider outside the EU. A fallback is only possible with an explicitly set switch that is off by default.
- 5Graphics servers for the avatar videos that the platform creates itself are only set up in data centres in the EU; they are rented from a provider based in the USA. Speech output works in the USA and only receives the text to be spoken.
Inställningar och reglage#
Inget eget reglage i katalogen — funktionen hör till sin omgivning.
Why this is a rule in the code#
When the installation was moved, it turned out that the application ran in a region outside the EU — not as a decision, but as the hosting's default for new projects. The database was in Frankfurt, the processing was not. Since then the region has been in the source code, and a test checks it: a setting in an administration interface is invisible, one in the source code appears in every change.
What is processed where#
- Database, file storage, sign-in — Frankfurt
- Application — an EU region
- Speech recognition — EU, without silent fallback
- The workshop's language model — optionally an EU-hosted model (Paris); which models a tenant uses, it decides itself
- Avatar videos — own machines in an EU data centre
Language models receive course content as context and the question — no names or account data; speech output receives the text to be spoken.
Tips#
- London is in Europe, but not in the EU — the test knows the difference.
- Whoever wants to know which data goes to which service finds this (after signing in as administration) under “Technology & Security” → “Data flows”.
Relaterade funktioner#
- Data protection: deletion calendar, dry run and reportDeletion requests, their records and the data held back because of retention obligations — with a deletion calendar, a dry run beforehand and a regular report to the data protection officer.
- How the platform is builtA web application that runs in the browser, with a relational database in Frankfurt and data centres in the EU — multi-tenant, multilingual, secured by thousands of automated tests.
- Database and tenant separationEvery table carries the organisation; the database itself decides who sees which row.
- AI on the platform — what it may and may not doAI writes suggestions, presents courses and answers questions — labelled, bound to sources and with fixed limits: it does not assess exam behaviour and decides nothing that a person must decide.
Bakgrundskunskap
- Learning platforms and data protection: checking EU hostingWhat data an LMS processes, what the GDPR requires, what EU hosting really means and how to check AI services, data processing and deletion.
- Data protection for AI in learning: GDPR and AI ActWhat matters when using AI in learning platforms: data flows, legal bases, prohibited practices, high-risk uses and transparency.
- Organising data protection training for employeesOrganising data protection training for staff: target groups, content per role, rhythm, comprehension checks and records that support GDPR accountability.
- An AI assistant for schools: using it in line with the GDPRWhat schools must consider when using an AI assistant: data protection, the AI Act, protection of minors, curriculum alignment, teacher control and operation.
- Data protection for learning platforms: DPA and transfersWhat to check with learning platforms: roles, processing agreements under Article 28 GDPR, third-country transfers, learning data and proctoring.