Trust & data

Where your data lives

Learner and school data is stored in a dedicated Supabase (PostgreSQL) project in the EU (Frankfurt, eu-central-1), served through Vercel. Every table is protected by row-level security: learners read their own rows, school admins read their school, nobody reads across schools — enforced by the database, not by application promises.

Subprocessors

• Supabase — database & authentication (EU region)
• Vercel — hosting & delivery
• Resend — transactional email (sponsor reports, learner check-ins, weekly admin digests). Resend sends via its EU (Ireland) region option; account metadata/logs are US-stored under DPA+SCCs. Same posture as the stack's other US processors.
• Anthropic — optional AI assistance (Guide Copilot / Student Companion), only when a school enables it; learner names and emails are stripped before any text reaches the model, and the AI can never review, grade, or certify

Laws enforced by construction

• Completion events are written by database triggers from real transitions — not self-reported, not editable by the app.
• Only a human reviewer can verify evidence or move a credential. AI assists; it never signs.
• Public credential pages show display fields only — no internal IDs; minors are never publicly named.
• Sponsor links show aggregates only, are revocable, and revocation is immediate.
• Assessment scores are write-only at the database level; even the application can only read coarse improvement bands.

Agreements & questions

A data-processing agreement (DPA) template is available for institutional engagements — request it at hello@apomlab.com. Data deletion and export requests are honored per PDPA/GDPR principles.

Operated by APO MLAB Pte Ltd, Singapore. African delivery via APOHUB AI Ltd, Kigali. We do not claim certifications we do not hold; this page states what is true today.