--- title: 'Nurture Signal sub-processors (Australia)' description: 'The sub-processors behind Nurture Signal’s Australian deployment: what each processes, where it is located, and when it applies.' canonical: 'https://www.gonurture.com/legal/signal-subprocessors' siteGuide: 'https://www.gonurture.com/llms.txt' --- V 1.0 · Updated 21 September 2026 [All legal documents](https://www.gonurture.com/legal.md) The sub-processor register for **Nurture Signal’s Australian deployment** (`au.gonurture.com`): every third-party provider that may process personal information on our behalf, what it receives, where it is, and when it applies. The European and global deployments use some different providers; ask us for their register. Canvas, where a school installs it, is the school’s own system rather than our sub-processor; its data flow is in the [DPIA pack](https://www.gonurture.com/legal/signal-dpia.md). The register for Nurture Assessments, a separate product, is in the [Security Centre](https://www.gonurture.com/security.md). ## Deployments Signal is deployed once per region, and a school’s data is stored in the one deployment that serves it. Data is always stored in Microsoft Azure in that deployment’s region: Nurture runs the database and object store itself rather than using a separate database service. The application runs on Azure or, for some cloud deployments, on Vercel, which stores no account records or session content. A school can instead run Signal entirely in its own Azure tenancy, where its own subscription holds everything. | Deployment | Hosts | Data stored in | | --- | --- | --- | | Australia | `au.gonurture.com`, `au-api-signal.gonurture.com`, `au-s3proxy-signal.gonurture.com` | Australia | | Europe | `eu.gonurture.com`, `eu-api-signal.gonurture.com`, `eu-s3proxy-signal.gonurture.com` | European Union | | Global (default) | `signal.gonurture.com`, `api-signal.gonurture.com`, `s3proxy-signal.gonurture.com` | United States | This table shows where data is **stored**. Some providers below process data outside that region; they are listed under [what leaves Australia](#what-leaves-australia). Your web filter needs the full Australian block from [allowlisting URLs](https://www.gonurture.com/docs/it-admins/allowlisting.md), not just these hosts. ## Sub-processors | Provider | Purpose | Data processed | Location | Applies to Australia | | --- | --- | --- | --- | --- | | Microsoft Azure | Database, file storage and networking, and compute where the application runs on Azure | All account and session data | Australia | Always | | Azure OpenAI Service | AI drafting, explanations, summaries and marking | The text a feature works on: teachers’ prompts and session content (including model answers hidden from students) and participants’ responses. No name, email or ID as a field; a name typed into text goes with it | Australia East | Where AI features are used | | Azure AI Search, AI Services, Blob Storage and OpenAI | Indexing and retrieval for curriculum grounding | Teaching material a teacher uploads, and passages from it. Uploads are not restricted, so this includes anything the document contains | Australia | Where grounding is enabled | | Microsoft Entra ID | Single sign-on with your directory | Account ID, name, email and profile picture (`openid`, `profile`, `email`, `User.Read`), and a refresh token (`offline_access`) | Your own tenant | Where you sign in with Microsoft | | Vercel | Runs the application for some cloud deployments, with web analytics on those deployments. Stores no account records or session content. Also hosts this marketing website | Requests and the pages they return, including the session content and sign-in details they carry, in transit. Page views (page, referrer, browser, device and country), without cookies or an account ID | Hosting: the region configured for the deployment. Analytics: not selected by us | Where your deployment’s application runs on Vercel | | Google | Single sign-on | Account ID, name, email and profile picture | Not selected by us | Where a user signs in with Google | | Resend | Emailing one-time sign-in codes | Recipient email address and the code | Outside Australia | Where email-code sign-in is used | | Sentry | Error monitoring | Diagnostics with no IP, cookies, request bodies or identity. Masked session replays of one in ten sessions and every session with an error, recording clicks and navigation | Not Australia | Always — not switchable per school | | Microsoft Clarity | Product analytics | Usage activity — pages and clicks — against a pseudonymous account ID, never a name or email | Not selected by us | Where configured | “Not selected by us” means the provider chooses the region; we can ask a provider to confirm one in writing if your assessment needs it. ## What leaves Australia Account information, session activity and everything participants write are stored in Australia, and AI generation and curriculum indexing run there. These paths reach a provider outside Australia: - **Application hosting on Vercel** — where your deployment’s application runs on Vercel, requests pass through it and its web analytics records page views without cookies or an account ID; data stays stored in Azure in Australia. We confirm your deployment’s hosting in writing. - **Email sign-in codes** — the recipient’s email address and the one-time code. We pin sign-in to your directory on request, which also stops the account-link code a teacher’s first Canvas launch would otherwise email. - **Sign-in with Google** — the user is identified to Google. Microsoft Entra signs in against your own tenant instead. - **Error monitoring** — diagnostics configured to exclude personal details, and masked session replays that still record clicks and navigation. Runs on every deployment and cannot be switched off per school. - **Product analytics** — usage activity, where configured. We can switch it off. Three more are not sub-processors, so they are not in the table: a **teacher’s connected AI assistant** or other tool a user connects to pull data they can already see, whose vendor the user chooses (we can switch assistants off for your school); **remote access by our staff** in Ireland; and **your own Canvas**, where installed, which receives the scores and assignment updates Signal writes wherever your school hosts it. All three are in the [DPIA pack](https://www.gonurture.com/legal/signal-dpia.md). If your school requires that **no** personal information leaves Australia, tell us before rollout. Section 12 of our DPA sets out the exceptions above. ## Not used by the Australian deployment - **Vercel AI Gateway** — the global deployment’s AI route. Australia uses its own Azure OpenAI resource instead. - **Latitude** — AI tracing used in development only, switched off wherever school data is handled. - **Slack** — an internal alert when a staff member first hosts. It is not enabled on deployments we host for schools. ## Changes to this register We update this page when a sub-processor is added, removed or replaced. Under our DPA you authorise us to appoint sub-processors, provided this list is kept current, and you may object where a change materially increases risk. The DPA does not promise advance notice; if you want it, email [support@gonurture.com](mailto:support@gonurture.com) and we will add you to our notification list. Any new service that receives request data, page content or user identity counts as a sub-processor. ## This register and your DPA Section 12 of our [DPA](https://www.gonurture.com/legal/gdpr.md) commits Nurture to storing account information and customer data in Australia for Australian deployments, and names the exceptions described above. **The DPA is the contractual position**; we confirm in writing how your deployment is configured. ## Related documents - [Nurture Signal security and data protection](https://www.gonurture.com/security/signal.md) - [Information for your DPIA (Australia)](https://www.gonurture.com/legal/signal-dpia.md) - [Permissions in Nurture Signal](https://www.gonurture.com/docs/it-admins/signal-permissions.md) - [Nurture Signal Privacy Policy](https://signal.gonurture.com/privacy) - [GDPR and Data Processing Agreement](https://www.gonurture.com/legal/gdpr.md)