Ethics Playground — Sub-processors and third-party services
Version 1.0 — 27 October 2026. Ethics Olympiad Pty Ltd. Updated whenever a service is added or removed; schools are told at least 30 days before a new sub-processor receives personal information. Published alongside the Privacy Policy.
| Service | Purpose | Personal information it receives | Location | Security assurances |
|---|---|---|---|---|
| Supabase (on Amazon Web Services) | Database, backups and teacher sign-in | All student and teacher data listed in the Privacy Policy; teacher passwords as hashes; two-step sign-in factors | Sydney, Australia (AWS ap-southeast-2) | Supabase: SOC 2 Type II. AWS: ISO 27001, IRAP-assessed (Sydney region). Encryption at rest (AES-256) and in transit (TLS 1.2+). Reports: supabase.com/security, aws.amazon.com/compliance |
| Vercel | Hosts the application and runs its server code | All data passes through our application servers in Sydney (region syd1) while being processed; request logs (no personal information by design) | Application servers: Sydney. Static files (images, fonts, scripts; no personal information) are served from Vercel's global network | SOC 2 Type II, ISO 27001. Reports: vercel.com/security |
| Resend | Sends password set-up and reset emails to teachers | Teacher email address and display name, and the one-time link | United States | SOC 2 Type II. Reports: resend.com/security |
| GitHub | Source code repository (private) | None; code only | United States | — |
Interim backup copies (until Supabase Pro backups are enabled): encrypted database exports are kept on the security lead's full-disk-encrypted computer in Australia and in a private storage bucket in a separate Supabase project in Sydney. No additional company receives personal information.
Not used: analytics or advertising services, error-reporting services, external fonts (self-hosted), external QR-code generators (removed October 2026), artificial-intelligence services, payment processors (schools are invoiced by Ethics Olympiad Pty Ltd outside the platform).
No personal information about students leaves Australia. The only personal information sent to a service outside Australia is a teacher's email address and display name, for password emails (Resend).
Change log
| Date | Change |
|---|---|
| 2026-10-27 | First published. api.qrserver.com (Germany; received class join links) removed from the platform in the October 2026 security release. External fonts removed in September 2026. |