Sub-processors
Version 1.9, effective 10 October 2026
OurNews is a product of Bolsta Education Pty Ltd (“OurNews”, “we”, “us”).
A sub-processor is a third party engaged by OurNews that processes, or may access, personal information OurNews handles on behalf of a school. For each, this list records the personal information it may access, where that information is stored, and where personnel able to access it are located. It is the list referred to in Schedule 1, clause 4.6 of the OurNews Subscription Agreement.
Roles
For School Content (everything the school uploads to or creates in OurNews, and the metadata attached to it), the school is the controller and OurNews is the processor. OurNews acts on the school’s instructions and processes School Content for no purpose of its own. Under the GDPR this is the Article 28 relationship. Under the Privacy Act 1988 (Cth), OurNews is treated as an APP entity.
For account data (the names, work email addresses and sign-in records of school staff users), for visitors’ book data (the email address and IP address recorded when a reader signs the visitors’ book for a story whose Access is Email required), and for the email address a person confirms when submitting a story, and the email address a reader gives when reporting a story, OurNews is the controller.
Under the GDPR and the UK GDPR, the lawful basis for processing School Content is the school’s to decide, as controller. OurNews processes School Content on the school’s instructions, under the Data Processing Terms at Schedule 1 of the Subscription Agreement. Clause 9.1 of Schedule 1 commits OurNews to engaging sub-processors on terms no less protective than Schedule 1, and to staying responsible for what they do. For the personal information OurNews controls, the lawful basis is legitimate interests (Article 6(1)(f)). That covers running and protecting staff accounts, recording who signs the visitors’ book so a school can see who opened a story, confirming the email address of a person who submits a story, replying to a reader who reports a story, rate limiting, and error monitoring.
OurNews holds no class lists, no parent or guardian contact details, no student identification numbers, no enrolment records, and no student information system integration.
Data residency
A school selects its region when its account is created: Australia, the European Union, the United Kingdom, the United States or Singapore. Each region is a separate stack, to be provisioned before OurNews opens its first account in a new region, at which point it confirms each sub-processor’s storage location for that region and reissues this page.
Two exceptions are marked below: Sentry stores in the United States or the European Union only; Cloudflare Turnstile operates on a global network.
Current sub-processors
| Sub-processor | Purpose | Personal information processed | Storage location | Personnel access locations |
|---|---|---|---|---|
| Supabase Pte. Ltd. | Database, staff authentication | Story text, photograph metadata, staff accounts, access log, submission and intake records, story reports | School’s chosen region | United States, Singapore |
| Amazon Web Services Australia Pty Ltd | Media storage, email, malware scanning, key management, database backup, fault alerts | Photographs and media, story email content and attachments, transactional email, the nightly database backup | School’s chosen region; fault alerts, see entry | Not limited by geography; see entry |
| Vercel Inc. | Application hosting, DNS and TLS, content delivery | Page content in transit; story-content functions pinned to the School’s region | United States (primary); content delivery global | Not stated by vendor |
| Functional Software, Inc. (Sentry) | Error monitoring | Scrubbed technical error data only: cookies, headers, request bodies, user identity and server name stripped before send | European Union (Frankfurt) | Austria, Canada, Netherlands, United States |
| Cloudflare, Inc. | Bot verification on publisher sign-in, story submission, story reports, the visitors’ book and the demonstration site | Visitor IP address, TLS fingerprint, user-agent | Global network | 17 countries; see entry |
| Upstash, Inc. | Rate limiting on authentication, story intake, the visitors’ book, story reports, reactions and intake-notify | Visitor IP address, a publisher’s user id, and an unsalted truncated email hash, as short-lived counter keys | School’s chosen region | Not stated by vendor |
Supabase Pte. Ltd.
Registered address 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513
Purpose Hosts the Postgres database holding School Content, and provides authentication for school staff accounts.
Personal information processed School Content other than media files (story text and version history, metadata and each story’s Visibility and Access settings), plus staff accounts and sessions, the access log, the submission and intake records (a submitter’s confirmed email and the story submission held during intake), and the reports readers send a school about a story (the reason, any photos pointed to, the reader’s words, and the reader’s email address if they gave one, deleted 30 days after the report). Media files are stored with Amazon Web Services, not Supabase.
Storage location The School’s chosen region, by project configuration. Data Processing Addendum clause 6.1 commits Supabase to storing and primarily processing Covered Data in a customer-directed region, subject to further customer instructions, applicable law, and the provision of the Services. The same clause reserves a general right to process anywhere Supabase or its sub-processors maintain facilities.
Personnel access locations United States and Singapore, per Supabase’s published Transfer Impact Assessment of 14 March 2025. Support is provided by Supabase, Inc. in the United States. Access requires a business need and personnel are bound to confidentiality under the Data Processing Addendum.
Data processing agreement Version 1, 1 August 2026. https://supabase.com/legal/customer-resources/data-processing-addendum
Sub-processor change notice 30 days, with a 5-day objection window, under clause 6.3, to customers subscribed to the notification mechanism on its sub-processor page.
Its own sub-processors 24 entries, dated 1 June 2026, at https://supabase.com/legal/customer-resources/subprocessor-list. Hosting is provided by Amazon Web Services, Google, Cloudflare, Fly.io and Vercel; Upstash provides serverless data hosting; Supabase, Inc. provides support services. Clause 6.2 binds each to obligations no less protective than Supabase’s own and keeps Supabase liable for their compliance.
Deletion Clause 11.2 gives a 30-day post-termination retrieval window, after which Supabase deletes all copies held by itself and its sub-processors.
Amazon Web Services Australia Pty Ltd
Registered address ABN 63 605 345 891, Level 37, 2-26 Park Street, Sydney, NSW 2000, Australia. AWS determines the contracting party by the account’s country, taken from the account’s tax registration or billing address. OurNews’s AWS account is held by Bolsta Education Pty Ltd in Australia.
Purpose Several services under one agreement. Amazon S3 stores four kinds of file under per-school key prefixes or per-day keys: uploads, the photo files OurNews re-encodes from them for serving, the raw mail of emailed story submissions until each is seeded or erased, and the nightly database backup. Amazon SES receives emailed story submissions and sends transactional email. GuardDuty Malware Protection for S3 scans uploads on write, and emailed attachments when they enter the media library; an uploaded file is unreadable until tagged clean, and files the scanner skips are treated as not clean. AWS KMS holds a per-region key that encrypts media; other data at rest is encrypted with AES-256 managed by the storage service. Amazon ECS on Fargate runs the nightly database backup, started by EventBridge Scheduler, with the database connection held in AWS Secrets Manager. Amazon SNS, Amazon EventBridge and Amazon CloudWatch carry email notices, scan results and fault alerts between these services, and Amazon SQS holds any backup start that fails. Amazon Q Developer in chat applications delivers OurNews’s own fault alerts to the founders’ Slack.
Personal information processed Photographs and other media, story email content and attachments, story reports emailed to a school’s coordinators, email addresses in transit, and the nightly database backup, a copy of the application’s data in the database Supabase hosts. Each backup is purged within 7 days.
Storage location The School’s chosen region for every service above except Amazon Q Developer in chat applications. AWS’s published commitment is general rather than service-specific: it will not move or replicate customer content outside chosen AWS Regions without agreement. AWS publishes no SES-specific residency statement. The fault alerts carry identifiers, resource names and fault details, never story text, photographs, names or email addresses, so they are not School Content, and AWS may store or process them in any of its commercial regions.
Personnel access locations Not limited by geography. The AWS Data Processing Addendum restricts personnel access by authorisation and confidentiality and names no country. By default, support cases may be assigned to engineers outside the customer’s country.
Data processing agreement AWS Data Processing Addendum, incorporated into the AWS Service Terms at section 1.14. https://d1.awsstatic.com/legal/aws-dpa/aws-dpa.pdf
Its own sub-processors https://aws.amazon.com/compliance/sub-processors/. AWS states that applicable sub-processors depend on the Region selected and the services used.
Vercel Inc.
Registered address A Delaware corporation, 440 N Barranca Ave #4133, Covina, CA 91723, United States
Purpose Hosts the OurNews application, holds authoritative DNS for school subdomains and issues their TLS certificates, delivers published pages through its content network, and runs the scheduled background job drain.
Personal information processed Page content in transit at request time. Background job payloads carry a school identifier and a story identifier only, never content. The function receiving emailed story submissions is pinned to the School’s region by OurNews configuration: syd1 for Australia.
Storage location United States. Data Processing Addendum section 13.1 states that Vercel’s primary processing facilities are in the United States, and that Vercel may transfer and process data anywhere Vercel or its sub-processors maintain operations. The content delivery network is global. Only content whose Access is Anyone is cached at the edge; Email-required surfaces are served no-store.
Personnel access locations Not stated by vendor. Vercel publishes no affiliate or group-company list and its Data Processing Addendum sets no geographic limit on personnel.
Data processing agreement Effective 31 March 2026. https://vercel.com/legal/dpa
Sub-processor change notice Notice by subscription (privacy@vercel.com), with a 5-day objection window under section 7.3. No advance notice period is stated.
Its own sub-processors Amazon Web Services, Google, Microsoft, Datadog and Honeycomb, at https://security.vercel.com.
Functional Software, Inc., d/b/a Sentry
Registered address 45 Fremont Street, 8th Floor, San Francisco, CA 94105, United States
Purpose Application error monitoring for OurNews developers.
Personal information processed Sentry receives a technical error report only: the error message, a stack trace and the time it happened. Nothing else is sent: no cookies, headers, request bodies, user identity, server names, and no School Content. Tracing and Session Replay are off. Live in production since 31 August 2026.
Storage location European Union (Frankfurt), selected at organisation creation, 9 August 2026. Sentry stores in the United States or the European Union only and cannot be pinned to a school’s region. This is an exception to the data residency model above; the applied control is minimisation rather than residency.
Personnel access locations Austria, Canada, the Netherlands and the United States, per Sentry’s published affiliate sub-processor entries.
Data processing agreement Version 5.1.0, 29 May 2024. https://sentry.io/legal/dpa/
Sub-processor change notice 30 days’ prior written notice.
Its own sub-processors Listed with locations at https://sentry.io/legal/subprocessors/, last updated 1 June 2026.
Cloudflare, Inc.
Registered address 101 Townsend Street, San Francisco, CA 94107, United States
Purpose Cloudflare Turnstile provides bot and automated-traffic verification on publisher sign-in, on the unauthenticated story submission endpoint, on the story report form, on the visitors’ book and on the demonstration site.
Personal information processed Per Cloudflare’s Turnstile privacy policy, the visitor’s IP address, TLS fingerprint, user-agent header, and the site key and its associated origin. Cloudflare states it cannot directly identify individuals from these signals. OurNews treats an IP address as personal information.
Storage location Cloudflare’s global network. This service cannot be pinned to a region and is an exception to the data residency model above.
Personnel access locations Australia, Canada, France, Germany, India, Japan, Malaysia, Mexico, the Netherlands, Portugal, Singapore, South Korea, Sweden, Switzerland, the United Arab Emirates, the United Kingdom and the United States. Cloudflare publishes 18 group companies across these 17 countries as sub-processors, stating that “employees of those affiliates may need to provide account and engineering support.”
Data processing agreement https://www.cloudflare.com/cloudflare-customer-dpa/
Sub-processor change notice 30 days, with a 10-day objection window.
Its own sub-processors Listed with locations at https://www.cloudflare.com/gdpr/subprocessors/, with an RSS feed for changes.
Upstash, Inc.
Registered address A Delaware corporation
Purpose Rate limiting on authentication endpoints, the story intake pipeline, the visitors’ book, the story report form, the reaction endpoint and the intake-notify webhook.
Personal information processed The counter keys used for rate limiting, held for the duration of the rate-limit window: the visitor IP address, a publisher’s user id for the per-person multi-factor verify budget, and an unsalted truncated hash of an email address for the password-reset and stamped-media budgets (pseudonymous; the raw address never leaves the application). No School Content, media or account data.
Storage location The School’s chosen region.
Personnel access locations Not stated by vendor. The Data Processing Addendum binds personnel to written confidentiality agreements without geographic limit, and Upstash publishes no affiliate list.
Data processing agreement Last updated April 2025. https://upstash.com/trust/dpa.pdf Restricted transfers are governed by the EU Standard Contractual Clauses (Modules Two and Three) and the UK International Data Transfer Addendum.
Sub-processor change notice Notice by publication of an updated list, with a 5-day objection window under section 9.2. Customers must register at https://trust.upstash.com to receive it.
Its own sub-processors https://trust.upstash.com/subprocessors. Amazon Web Services is its cloud provider.
Changes to this list
OurNews gives at least 30 days’ written notice before adding or replacing a sub-processor at its own initiative. A school may object on reasonable grounds.
Where a sub-processor changes its own supply chain, the notice OurNews can give is limited to the notice it receives. Supabase, Sentry and Cloudflare each commit to 30 days. Vercel and Upstash operate a 5-day objection window with no stated advance period. Where less than 30 days is received, OurNews passes the change on promptly and states the notice period given by the sub-processor.
OurNews regularly monitors each sub-processor for changes, subscribing to change notifications where the sub-processor offers them.
Superseded versions of this page are retained and available on request.
Version history
| Version | Date | Change |
|---|---|---|
| 1.0 | 14 August 2026 | First published |
| 1.1 | 31 August 2026 | Cloudflare purpose widened to publisher sign-in; Upstash purpose widened to the reveal gate, reactions and intake-notify; Sentry entry aligned to the live errors-only instrumentation and its scrubbing detailed. No new sub-processors; no change to personal-information categories. |
| 1.2 | 1 September 2026 | Upstash’s personal-information categories gain a third entry: an unsalted truncated email hash used as a rate-limit counter key for the password-reset and stamped-media budgets. No new sub-processors. |
| 1.3 | 12 September 2026 | Replaced the reveal gate and reveal-gate log terminology with visitors’ book and access log, and “verifies”/“verified” with “confirms”/“confirmed”, matching the Visibility and Access model (Schedule 1 clause 4.2, v1.4). No new sub-processors; no change to personal-information categories. |
| 1.4 | 13 September 2026 | Cloudflare purpose completed to name the demonstration site, aligning the list with the privacy policy and the code’s verified surfaces. No new sub-processors; no change to personal-information categories. |
| 1.5 | 24 September 2026 | Roles gains a lawful-basis paragraph: the school decides the basis for School Content, which OurNews processes on its instructions under Schedule 1, and OurNews relies on legitimate interests for the personal information it controls. No new sub-processors; no change to personal-information categories. |
| 1.6 | 1 October 2026 | Supabase’s personal information gains story reports, and Cloudflare’s purpose gains the story report form. AWS’s purpose names its two media buckets and scopes the malware-scan gate to uploads. No new sub-processors. |
| 1.7 | 7 October 2026 | AWS’s entry names every service OurNews runs on it: the intake and backup buckets, the nightly backup on ECS Fargate with Secrets Manager and EventBridge Scheduler, the notice and alert services, and Amazon Q Developer in chat applications for OurNews’s own fault alerts, which are not School Content (OUR-2884). AWS’s personal information gains the nightly database backup. No new sub-processors. |
| 1.8 | 10 October 2026 | “Roles” and the lawful-basis paragraph say OurNews acts on the school’s instructions, matching Schedule 1 v1.6 clause 1.1 (OUR-1074). No new sub-processors. |
| 1.9 | 10 October 2026 | “Roles” and the lawful-basis paragraph name the email address a reader gives when reporting a story as data OurNews controls (OUR-2549). No new sub-processors. |
Contact
Questions about this page, objections to a sub-processor, and requests for a superseded version: hello@bolsta.education
Requests to access or correct personal information held by OurNews go to the same address. Where the information relates to a student or a family, OurNews works with the school, which holds the relationship and the consent.