Trust Centre
Your students' data is stored in Australia, in AWS Sydney.
Your system of record lives in the AWS Sydney region. The exceptions are limited, diagnostic-only, and disclosed.
Your system of record, all application data, is hosted in Australia, in the AWS Sydney region (ap-southeast-2), with app hosting in the same region.
A number of supporting subprocessors operate in the United States (transactional email, optional crisis SMS, scrubbed error diagnostics, staff-facing AI features, and per-tenant Slack where an institution enables it) and a small number operate in the European Union (privacy-first analytics on our public knowledge base, and independent uptime monitoring). The data they touch is scrubbed of personal information or minimised before it leaves the app, and every subprocessor and its region is disclosed in our subprocessor list.
About the exceptions
The system of record stays in Australia. A few supporting services sit overseas for a specific job. This is exactly how that's kept tight.
01
The record lives in Sydney
All application data (enrolment, wellbeing check-ins, help requests) is stored in AWS Sydney (ap-southeast-2), with app hosting in the same region.
02
Overseas services are scoped to a job
Some subprocessors operate in the United States (transactional email, optional crisis SMS, scrubbed diagnostics, AI features, and per-tenant Slack) and a small number in the European Union (privacy-first analytics on the public knowledge base, and independent uptime monitoring). Each sees only what its job needs.
03
Personal data is minimised before it leaves
Diagnostics are scrubbed of personal information before they're sent, and what reaches each overseas service is limited to its purpose.
04
Everything is disclosed
Every subprocessor, its purpose, and its region is listed openly in our subprocessor list, kept current and dated.
Where each kind of data sits
A plain map of what lives where, and why.
The system of record: Australia
The Supabase-managed Postgres database, authentication, and file storage all run in AWS Sydney. This is where student data lives.
Application hosting
Compute runs in the Sydney region; static assets are served from a global CDN, which never holds the system of record.
Transactional email
Sign-in links and notifications go out via SendGrid (US), which sees only the recipient address and message.
Diagnostics
Error monitoring via Sentry (US) receives diagnostics scrubbed of personal data before they leave.
Optional crisis SMS
Where an institution enables it, Twilio (US) sends crisis messages and sees only the recipient number and message.
Need the full data-flow detail?
Request our subprocessor list and data residency summary.
What we never do
Support means seeing the pattern, not the person. These limits are built into the product, not just promised in a policy.
We never sell or share student data
Student data is used to run First Six for your institution — never sold, rented, or handed to advertisers or data brokers. Full stop.
We never build watchlists
Individual wellbeing answers stay private to the student. Staff see aggregate trends with small groups suppressed — never a named list of who to watch.
We never train external AI on student data
Student records are not used to train third-party models. AI features process only what staff submit, and that content is not retained for training.
We never hide where data lives
The system of record stays in Australia, and every subprocessor and region is listed openly here in the Trust Centre. No surprises.
Frequently asked questions
What security, privacy, and procurement teams ask us most.
In Australia, the AWS Sydney region (ap-southeast-2). The managed database, authentication, and file storage that make up the system of record all sit there.
The system of record stays in Australia. A few supporting services sit overseas for specific jobs (transactional email, optional crisis SMS, scrubbed diagnostics, and staff-facing AI), and what reaches each is limited to that purpose. All are disclosed in our subprocessor list.
The student system of record does. We're upfront that some operational functions (email, diagnostics, optional SMS) use reputable overseas providers; we minimise what they see and list them openly, instead of implying a hard guarantee we can't keep.
Because the best-in-class providers for transactional email, error monitoring, and AI features are US-based, and the alternative would be weaker tooling. We contain the trade-off by scrubbing and minimising the data they touch.
Application data is hosted on AWS in Sydney via Supabase (managed Postgres, auth, storage), with app compute on Vercel's Sydney region. Both are named in our subprocessor list.
See it for your next cohort.
Currently meeting with universities.