Sub-processors Policy
Information regarding the third-party services we engage to deliver Inkcraft Studio.
Overview
To provide the Inkcraft Studio and Inkcraft Report platforms, Inkcraft Education Pty Ltd ("we", "us") engages certain third-party service providers ("Sub-processors") to assist with data processing and platform functionality. We maintain strict agreements with these providers to ensure your data is protected in alignment with ST4S framework standards and Australian privacy laws.
Data Localisation & Tenant Isolation
Inkcraft Studio is designed with a secure cloud architecture. Student data is hosted on Australian infrastructure (Fly.io, Sydney). Each school is provisioned a completely separate, dedicated database to ensure strict tenant isolation and prevent cross-institutional data mixing. We do not transmit Student Personally Identifiable Information (PII) to any external AI or analytics sub-processors.
Inkcraft Report employs client-side PII stripping — all student names and identifiable information are removed in the teacher's browser before any text is transmitted to our servers or AI processing partners. Only anonymised, de-identified text is processed externally.
Authorised Sub-processors
Below is the current list of Sub-processors authorised to process data on behalf of Inkcraft Education:
Google LLC (Google Cloud / Google Gemini)
Purpose: Curriculum-aligned question generation, reading passage creation, mathematical modelling (Inkcraft Studio), and AI-powered report comment proofreading (Inkcraft Report).
Data Processed: Strictly anonymised curriculum standards, generic prompts, and de-identified report comment text. No student PII is transmitted to Google. All PII is stripped client-side before transmission.
Location: Global (API processing). No student PII leaves Australia as all identifiable information is removed before any API call.
Fly.io, Inc.
Purpose: Cloud application hosting and infrastructure for Inkcraft Studio and Inkcraft Report web applications and databases.
Data Processed: Application data, user account information, session data, student assessment data (in isolated tenant databases), and encrypted database backups.
Location: Sydney, Australia (SYD region).
Stripe, Inc.
Purpose: Secure payment processing for Inkcraft Report individual teacher subscriptions and institutional invoice payments.
Data Processed: Payment card details, billing address, and transaction records. Inkcraft Education does not store credit card numbers on our servers — all payment data is handled directly by Stripe under PCI DSS Level 1 compliance.
Location: Global (with Australian payment processing endpoints).
Tigris Data, Inc.
Purpose: Secure, off-site external S3-compatible object storage for scheduled, encrypted database backups from our Fly.io hosting environment.
Data Processed: Encrypted snapshots of application databases and tenant data.
Location: Sydney, Australia (syd region).
Updates to this List
We will provide schools with at least 30 days prior written notice of any intended changes concerning the addition or replacement of Sub-processors, giving you the opportunity to object to such changes.