Where is learner data stored and processed, in the UK and elsewhere?

“Where is our data?” is one of the first questions a data protection officer asks, and the honest answer is rarely a single place. A modern web application uses several services, and each one can process data in a different location. This page maps each layer separately, says what is decided, and says what is not.

Where is learner data stored, and is it UK-only?

Learner data is stored mainly in the application database, which is planned to run in London, UK. Inclusion Studio is not UK-only: we do not describe it as UK-only or wholly UK-hosted. Our approach is: keep the primary application database in the UK, and document and lawfully assess any processing that happens elsewhere. If your organisation requires strictly UK-only processing for every service, tell us early. That would be a separate procurement and architecture decision, and we will not promise that the current design meets it.

Today no real learner data is processed anywhere. The production application uses synthetic data only.

Where does each part of the service run?

Why is the database the part that stays in London?

The database holds the substance of the learner record: the learner’s voice, the agreed support plan, delivery records, reviews and permissions. Neon offers an AWS Europe (London) region, aws-eu-west-2, and our production database is planned to run there. Database backups and recovery arrangements still need to be confirmed and tested.

What data goes to the sign-in provider?

Only what sign-in needs: for example a name, email address, sign-in method and MFA settings. We do not store diagnoses, SEND details, support histories or case notes in the identity service. Clerk’s own security page currently says it is US-hosted and does not offer regional data residency. That makes sign-in an international transfer, which we will assess and document before real learner data is used.

What does “London preferred” mean for hosting?

Vercel lets us choose the region where server functions run. New projects default to Washington, D.C. (iad1), so we will set London (lhr1) for supported application compute. However, static pages and assets are served from Vercel’s global network, and some platform features run in many regions. Vercel’s logs and support access also need separate review. That is why we say “London preferred” rather than “UK-hosted”.

Where will uploaded documents be stored?

In a private Vercel Blob store. Vercel lets you pick the store’s region when you create it, and the region cannot be changed afterwards. We have not created the production store yet. We will choose the region deliberately, preferring the UK where it is available, and publish the decision here. Vercel’s network may also cache file content between storage and our server, so we will review caching separately from where the original file is stored.

What about AI?

Gemini on Google Cloud Vertex AI is the selected AI provider. It has been exercised with synthetic data only, in a preview environment, at an EU multi-region endpoint accepted for preview use. Where real learner data would be processed is not decided, the live application uses a mock, and no real learner data has been sent to any AI provider. Before any real record reaches an AI model, we will record the processing location, retention and training terms, and any fallback behaviour. There will be no silent switch to a different provider or region. See our AI principles.

What about logs, backups, support access and email?

Each is mapped separately because each can move data somewhere different:

• Logs and telemetry: designed to be redacted so they do not carry learner content. Provider to be selected.
• Backups: database and file backups are separate and will be documented and restore-tested.
• Support access: vendor support staff and our own staff access will be limited, logged and covered by contract.
• Email: notifications will carry the minimum content needed. Provider to be selected.

When will this page change?

Whenever a decision is made. We will update the table as providers are selected and regions confirmed, and list each one on our subprocessors page. The assurance roadmap sets out the checks that must be complete before real learner data is used.