Nurture Signal sub-processors (Australia)
The sub-processor register for Nurture Signal’s Australian deployment
(au.gonurture.com): every third-party provider that may process personal
information on our behalf, what it receives, where it is, and when it applies.
The European and global deployments use some different providers; ask us for
their register.
Canvas, where a school installs it, is the school’s own system rather than our sub-processor; its data flow is in the DPIA pack. The register for Nurture Assessments, a separate product, is in the Security Centre.
Deployments
Signal is deployed once per region, and a school’s data is stored in the one deployment that serves it. Data is always stored in Microsoft Azure in that deployment’s region: Nurture runs the database and object store itself rather than using a separate database service. The application runs on Azure or, for some cloud deployments, on Vercel, which stores no account records or session content. A school can instead run Signal entirely in its own Azure tenancy, where its own subscription holds everything.
| Deployment | Hosts | Data stored in |
|---|---|---|
| Australia |
| Australia |
| Europe |
| European Union |
| Global (default) |
| United States |
This table shows where data is stored. Some providers below process data outside that region; they are listed under what leaves Australia. Your web filter needs the full Australian block from allowlisting URLs, not just these hosts.
Sub-processors
| Provider | Purpose | Data processed | Location | Applies to Australia |
|---|---|---|---|---|
| Microsoft Azure | Database, file storage and networking, and compute where the application runs on Azure | All account and session data | Australia | Always |
| Azure OpenAI Service | AI drafting, explanations, summaries and marking | The text a feature works on: teachers’ prompts and session content (including model answers hidden from students) and participants’ responses. No name, email or ID as a field; a name typed into text goes with it | Australia East | Where AI features are used |
| Azure AI Search, AI Services, Blob Storage and OpenAI | Indexing and retrieval for curriculum grounding | Teaching material a teacher uploads, and passages from it. Uploads are not restricted, so this includes anything the document contains | Australia | Where grounding is enabled |
| Microsoft Entra ID | Single sign-on with your directory | Account ID, name, email and profile picture ( | Your own tenant | Where you sign in with Microsoft |
| Vercel | Runs the application for some cloud deployments, with web analytics on those deployments. Stores no account records or session content. Also hosts this marketing website | Requests and the pages they return, including the session content and sign-in details they carry, in transit. Page views (page, referrer, browser, device and country), without cookies or an account ID | Hosting: the region configured for the deployment. Analytics: not selected by us | Where your deployment’s application runs on Vercel |
| Single sign-on | Account ID, name, email and profile picture | Not selected by us | Where a user signs in with Google | |
| Resend | Emailing one-time sign-in codes | Recipient email address and the code | Outside Australia | Where email-code sign-in is used |
| Sentry | Error monitoring | Diagnostics with no IP, cookies, request bodies or identity. Masked session replays of one in ten sessions and every session with an error, recording clicks and navigation | Not Australia | Always — not switchable per school |
| Microsoft Clarity | Product analytics | Usage activity — pages and clicks — against a pseudonymous account ID, never a name or email | Not selected by us | Where configured |
“Not selected by us” means the provider chooses the region; we can ask a provider to confirm one in writing if your assessment needs it.
What leaves Australia
Account information, session activity and everything participants write are stored in Australia, and AI generation and curriculum indexing run there. These paths reach a provider outside Australia:
- Application hosting on Vercel — where your deployment’s application runs on Vercel, requests pass through it and its web analytics records page views without cookies or an account ID; data stays stored in Azure in Australia. We confirm your deployment’s hosting in writing.
- Email sign-in codes — the recipient’s email address and the one-time code. We pin sign-in to your directory on request, which also stops the account-link code a teacher’s first Canvas launch would otherwise email.
- Sign-in with Google — the user is identified to Google. Microsoft Entra signs in against your own tenant instead.
- Error monitoring — diagnostics configured to exclude personal details, and masked session replays that still record clicks and navigation. Runs on every deployment and cannot be switched off per school.
- Product analytics — usage activity, where configured. We can switch it off.
Three more are not sub-processors, so they are not in the table: a teacher’s connected AI assistant or other tool a user connects to pull data they can already see, whose vendor the user chooses (we can switch assistants off for your school); remote access by our staff in Ireland; and your own Canvas, where installed, which receives the scores and assignment updates Signal writes wherever your school hosts it. All three are in the DPIA pack.
If your school requires that no personal information leaves Australia, tell us before rollout. Section 12 of our DPA sets out the exceptions above.
Not used by the Australian deployment
- Vercel AI Gateway — the global deployment’s AI route. Australia uses its own Azure OpenAI resource instead.
- Latitude — AI tracing used in development only, switched off wherever school data is handled.
- Slack — an internal alert when a staff member first hosts. It is not enabled on deployments we host for schools.
Changes to this register
We update this page when a sub-processor is added, removed or replaced. Under our DPA you authorise us to appoint sub-processors, provided this list is kept current, and you may object where a change materially increases risk. The DPA does not promise advance notice; if you want it, email support@gonurture.com and we will add you to our notification list. Any new service that receives request data, page content or user identity counts as a sub-processor.
This register and your DPA
Section 12 of our DPA commits Nurture to storing account information and customer data in Australia for Australian deployments, and names the exceptions described above. The DPA is the contractual position; we confirm in writing how your deployment is configured.