Data and privacy
Where records live, and who can open them.
Families, staff and customers ask where their information is kept and who can see it. A vague answer loses trust, so here is the specific one, using XTutio as the example.
Where the data is
We tell you exactly where your data and AI requests go.
The database runs in Supabase's Sydney region (ap-southeast-2) and the app is hosted on Vercel's Sydney region (syd1). Some services that support a product sit outside Australia, and we list those too.
| What | Where | When |
|---|---|---|
| Database, sign-in and stored filesAlways | Sydney, Australia (Supabase, AWS ap-southeast-2) | Always |
| Website and app hostingAlways | Sydney, Australia (Vercel, syd1) | Always |
| AI requestsSet per customer. See AI in Australia | Amazon Bedrock in Sydney, Melbourne as backup, then Anthropic in the United States as a last fallback | Set per customer. See AI in Australia |
| Product analyticsOnly after a visitor accepts analytics cookies | European Union | Only after a visitor accepts analytics cookies |
| Outgoing emailOnly for customers who use XTutio's email account | Tokyo, Japan, for the sending domains XTutio sets up | Only for customers who use XTutio's email account |
Customers are kept apart
Every row carries its organisation
Each record is stamped with the customer it belongs to.
The database enforces it
Row-level security in the database refuses a read or change from another customer, not just the application code.
Checked on every change
Guard scripts in the build check every query and migration for that boundary, and refuse ones that forget it.
Credentials are encrypted
Third-party credentials a customer saves are stored per customer, encrypted with AES-256-GCM.
Names stay out of AI prompts
Names are replaced with pseudonyms before any AI request, and contact details are scrubbed.
Support access is explained
XTutio platform staff open a customer's account only to support it, give a reason each time, and each visit is recorded.
Keeping and leaving
A customer who leaves can ask for a copy of their data and receive it within 30 days. Financial records are kept for seven years because tax law requires it, and child safety records are kept and are not deleted on request. Nothing is deleted on a timer after an account closes.
These are the practices behind XTutio, our own product, and the foundation we start client builds from. What applies to a particular build is agreed in its scope, and we say so in writing.