Sub-processors
Version 1.0, effective 14 August 2026
OurNews is a product of Bolsta Education Pty Ltd (“OurNews”, “we”, “us”).
A sub-processor is a third party engaged by OurNews that processes, or may access, personal information OurNews handles on behalf of a school. This page lists every current sub-processor, the personal information each may access, where that information is stored, and where personnel able to access it are located. It is the list referred to in Schedule 1, clause 4.6 of the OurNews Subscription Agreement.
Roles
For School Content (everything the school uploads to or creates in OurNews, and the metadata attached to it), the school is the controller and OurNews is the processor. OurNews acts only on the school’s instructions and processes School Content for no purpose of its own. Under the GDPR this is the Article 28 relationship. Under the Privacy Act 1988 (Cth), OurNews is treated as an APP entity.
For account data (the names, work email addresses and sign-in records of school staff users) and for reveal-gate visitor data (the email address and IP address recorded when a reader confirms their address to view a protected story), OurNews is the controller.
OurNews holds no class lists, no parent or guardian contact details, no student identification numbers, no enrolment records, and no student information system integration.
Data residency
A school selects its region when its account is created: Australia, the European Union, the United Kingdom, the United States or Singapore. Each region is a separate stack, to be provisioned before OurNews opens its first account in a new region, at which point it confirms each sub-processor’s storage location for that region and reissues this page.
Two exceptions are marked below: Sentry stores in the United States or the European Union only; Cloudflare Turnstile operates on a global network.
Current sub-processors
| Sub-processor | Purpose | Personal information processed | Storage location | Personnel access locations |
|---|---|---|---|---|
| Supabase Pte. Ltd. | Database, staff authentication | Story text, photograph metadata, staff accounts, reveal-gate log | School’s chosen region | United States, Singapore |
| Amazon Web Services Australia Pty Ltd | Media storage, email, malware scanning, key management | Photographs and media, story email content and attachments, transactional email | School’s chosen region | Not limited by geography; see entry |
| Vercel Inc. | Application hosting, DNS and TLS, content delivery | Page content in transit; story-content functions pinned to the School’s region | United States (primary); content delivery global | Not stated by vendor |
| Functional Software, Inc. (Sentry) | Error monitoring | Scrubbed technical error data only | European Union (Frankfurt) | Austria, Canada, Netherlands, United States |
| Cloudflare, Inc. | Bot verification on story intake and the reveal gate | Visitor IP address, TLS fingerprint, user-agent | Global network | 17 countries; see entry |
| Upstash, Inc. | Rate limiting on authentication and story intake | Visitor IP address, as a short-lived counter key | School’s chosen region | Not stated by vendor |
Supabase Pte. Ltd.
Registered address 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513
Purpose Hosts the Postgres database holding School Content, and provides authentication for school staff accounts.
Personal information processed School Content other than media files (story text and version history, metadata and visibility settings), plus staff accounts and sessions, and the reveal-gate log. Media files are stored with Amazon Web Services, not Supabase.
Storage location The School’s chosen region, by project configuration. Data Processing Addendum clause 6.1 commits Supabase to storing and primarily processing Covered Data in a customer-directed region, subject to further customer instructions, applicable law, and the provision of the Services. The same clause reserves a general right to process anywhere Supabase or its sub-processors maintain facilities.
Personnel access locations United States and Singapore, per Supabase’s published Transfer Impact Assessment of 14 March 2025. Support is provided by Supabase, Inc. in the United States. Access requires a business need and personnel are bound to confidentiality under the Data Processing Addendum.
Data processing agreement Version 1, 1 August 2026. https://supabase.com/legal/customer-resources/data-processing-addendum
Sub-processor change notice 30 days, with a 5-day objection window, under clause 6.3, to customers subscribed to the notification mechanism on its sub-processor page.
Its own sub-processors 24 entries, dated 1 June 2026, at https://supabase.com/legal/customer-resources/subprocessor-list. Hosting is provided by Amazon Web Services, Google, Cloudflare, Fly.io and Vercel; Upstash provides serverless data hosting; Supabase, Inc. provides support services. Clause 6.2 binds each to obligations no less protective than Supabase’s own and keeps Supabase liable for their compliance.
Deletion Clause 11.2 gives a 30-day post-termination retrieval window, after which Supabase deletes all copies held by itself and its sub-processors.
Amazon Web Services Australia Pty Ltd
Registered address ABN 63 605 345 891, Level 37, 2-26 Park Street, Sydney, NSW 2000, Australia. AWS determines the contracting party by the account’s country, taken from the account’s tax registration or billing address. OurNews’s AWS account is held by Bolsta Education Pty Ltd in Australia.
Purpose Four services under one agreement. Amazon S3 stores photographs and uploaded files, one bucket per region, under per-school key prefixes. Amazon SES receives emailed story submissions and sends transactional email. GuardDuty Malware Protection for S3 scans every upload on write; an object is unreadable until tagged clean, and objects the scanner skips are treated as not clean. AWS KMS holds the encryption keys.
Personal information processed Photographs and other media, story email content and attachments, and email addresses in transit.
Storage location The School’s chosen region for all four services. AWS’s published commitment is general rather than service-specific: it will not move or replicate customer content outside chosen AWS Regions without agreement. AWS publishes no SES-specific residency statement.
Personnel access locations Not limited by geography. The AWS Data Processing Addendum restricts personnel access by authorisation and confidentiality and names no country. By default, support cases may be assigned to engineers outside the customer’s country.
Data processing agreement AWS Data Processing Addendum, incorporated into the AWS Service Terms at section 1.14. https://d1.awsstatic.com/legal/aws-dpa/aws-dpa.pdf
Its own sub-processors https://aws.amazon.com/compliance/sub-processors/. AWS states that applicable sub-processors depend on the Region selected and the services used.
Vercel Inc.
Registered address A Delaware corporation, 440 N Barranca Ave #4133, Covina, CA 91723, United States
Purpose Hosts the OurNews application, holds authoritative DNS for school subdomains and issues their TLS certificates, delivers published pages through its content network, and runs the scheduled background job drain.
Personal information processed Page content in transit at request time. Background job payloads carry a school identifier and a story identifier only, never content. The function receiving emailed story submissions is pinned to the School’s region by OurNews configuration: syd1 for Australia.
Storage location United States. Data Processing Addendum section 13.1 states that Vercel’s primary processing facilities are in the United States, and that Vercel may transfer and process data anywhere Vercel or its sub-processors maintain operations. The content delivery network is global. Only published content is cached at the edge; gated and link-only surfaces are served no-store.
Personnel access locations Not stated by vendor. Vercel publishes no affiliate or group-company list and its Data Processing Addendum sets no geographic limit on personnel.
Data processing agreement Effective 31 March 2026. https://vercel.com/legal/dpa
Sub-processor change notice Notice by subscription (privacy@vercel.com), with a 5-day objection window under section 7.3. No advance notice period is stated.
Its own sub-processors Amazon Web Services, Google, Microsoft, Datadog and Honeycomb, at https://security.vercel.com.
Functional Software, Inc., d/b/a Sentry
Registered address 45 Fremont Street, 8th Floor, San Francisco, CA 94105, United States
Purpose Application error monitoring for OurNews developers.
Personal information processed None collected by configuration. PII collection is disabled, scrubbing runs server-side before transmission, request bodies are not sent, and no School Content is sent. Session Replay is disabled.
Storage location European Union (Frankfurt), selected at organisation creation, 9 August 2026. Sentry stores in the United States or the European Union only and cannot be pinned to a school’s region. This is an exception to the data residency model above; the applied control is minimisation rather than residency.
Personnel access locations Austria, Canada, the Netherlands and the United States, per Sentry’s published affiliate sub-processor entries.
Data processing agreement Version 5.1.0, 29 May 2024. https://sentry.io/legal/dpa/
Sub-processor change notice 30 days’ prior written notice.
Its own sub-processors Listed with locations at https://sentry.io/legal/subprocessors/, last updated 1 June 2026.
Cloudflare, Inc.
Registered address 101 Townsend Street, San Francisco, CA 94107, United States
Purpose Cloudflare Turnstile provides bot and automated-traffic verification on the unauthenticated story intake endpoint and on the reveal gate.
Personal information processed Per Cloudflare’s Turnstile privacy policy, the visitor’s IP address, TLS fingerprint, user-agent header, and the site key and its associated origin. Cloudflare states it cannot directly identify individuals from these signals. OurNews treats an IP address as personal information.
Storage location Cloudflare’s global network. This service cannot be pinned to a region and is an exception to the data residency model above.
Personnel access locations Australia, Canada, France, Germany, India, Japan, Malaysia, Mexico, the Netherlands, Portugal, Singapore, South Korea, Sweden, Switzerland, the United Arab Emirates, the United Kingdom and the United States. Cloudflare publishes 18 group companies across these 17 countries as sub-processors, stating that “employees of those affiliates may need to provide account and engineering support.”
Data processing agreement https://www.cloudflare.com/cloudflare-customer-dpa/
Sub-processor change notice 30 days, with a 10-day objection window.
Its own sub-processors Listed with locations at https://www.cloudflare.com/gdpr/subprocessors/, with an RSS feed for changes.
Upstash, Inc.
Registered address A Delaware corporation
Purpose Rate limiting on authentication endpoints and the story intake pipeline.
Personal information processed The visitor IP address used as a rate-limit counter key, held for the duration of the rate-limit window. No School Content, media or account data.
Storage location The School’s chosen region.
Personnel access locations Not stated by vendor. The Data Processing Addendum binds personnel to written confidentiality agreements without geographic limit, and Upstash publishes no affiliate list.
Data processing agreement Last updated April 2025. https://upstash.com/trust/dpa.pdf Restricted transfers are governed by the EU Standard Contractual Clauses (Modules Two and Three) and the UK International Data Transfer Addendum.
Sub-processor change notice Notice by publication of an updated list, with a 5-day objection window under section 9.2. Customers must register at https://trust.upstash.com to receive it.
Its own sub-processors https://trust.upstash.com/subprocessors. Amazon Web Services is its cloud provider.
Changes to this list
OurNews gives at least 30 days’ written notice before adding or replacing a sub-processor at its own initiative. A school may object on reasonable grounds.
Where a sub-processor changes its own supply chain, the notice OurNews can give is limited to the notice it receives. Supabase, Sentry and Cloudflare each commit to 30 days. Vercel and Upstash operate a 5-day objection window with no stated advance period. Where less than 30 days is received, OurNews passes the change on promptly and states the notice period given by the sub-processor.
OurNews regularly monitors each sub-processor for changes, subscribing to change notifications where the sub-processor offers them.
Superseded versions of this page are retained and available on request.
Version history
| Version | Date | Change |
|---|---|---|
| 1.0 | 14 August 2026 | First published |
Contact
Questions about this page, objections to a sub-processor, and requests for a superseded version: hello@bolsta.education
Requests to access or correct personal information held by OurNews go to the same address. Where the information relates to a student or a family, OurNews works with the school, which holds the relationship and the consent.