Security and data
Where your records live,and who can open them.
Owners are asked by families, and by their own staff, who can see a child's records and where they are kept, and a vague answer loses trust. Here is ours: every record is stamped with your centre and the database keeps other centres out, staff sign in with two steps, sensitive actions are written down first, and every service we use is listed below.
Your records are stored in
Sydney, Australia
- Database, sign-in, files
- Sydney, Australia (AWS ap-southeast-2)
- Website and portal
- Sydney, Australia (syd1)
- Every record
- Stamped with its centre
Platform staff
- where your records are stored
- Sydney
- services we use, all listed
- 20
- years financial records are kept
- 7
- days to set up two-step sign-in
- 14
Where data is stored
Families ask where their data lives. Stated from where it really runs.
Where your records are stored
The database, sign-in and stored files run in Sydney, Australia (AWS ap-southeast-2), and the website and portal are served from Sydney, Australia (syd1).
Where AI requests may go
AI requests go to Anthropic in the United States, unless your centre is on Australian AI hosting: then most are processed by Amazon Bedrock in Sydney, with Melbourne as the backup, and go to Anthropic only if neither can answer. A few AI features always go to Anthropic. A person's name is replaced before any request leaves.
Email, calls and maps
Email goes out through our email provider, live video travels through our video provider's servers, and addresses are looked up with a maps provider. Each is in the list below, with where it runs when that is fixed.
On the screen
Ava wants help with her persuasive essay. Her mum Mia is on 0400 000 000.
What the AI model receives
Student A wants help with her persuasive essay. Her mum Parent of Student A is on [phone number removed].
The child sees: “Let's try that another way. What would you like to work on next?”
Sub-processors
Every service we use, and what for.
These run the platform for every centre. Where a region depends on the provider's own setup and we have not confirmed it, it says so.
| Service | What it does | Where | When it is used |
|---|---|---|---|
| Supabase | The database, sign-in and stored files for every centre. | Where: Sydney, Australia (AWS ap-southeast-2) | Always |
| Vercel | Hosting: serves the website and the portal and runs the scheduled jobs. | Where: Sydney, Australia (syd1) | Always |
| Sentry | Error monitoring. A person's name, email address and internet address are removed from the report itself; Sentry still sees the internet address of the device that sends it, unless its own setting discards it. | Where: Not yet confirmed | Always |
| PostHog | Product analytics: which pages and buttons staff and parents use, including the words on what they click (which can include a child's name), and a masked recording of some staff screens, after a visitor accepts analytics cookies. Students' own use is never sent. | Where: European Union | Only after a visitor accepts analytics cookies |
| Stripe | Charges a centre's XTutio subscription to the centre's card. | Where: Not yet confirmed | For every centre on a paid subscription |
| Amazon Web Services (Amazon Bedrock) | Processes AI requests in Australia for a centre on Australian AI hosting. | Where: Sydney, Australia, with Melbourne as the backup | Only for a centre on Australian AI hosting |
| Anthropic | The AI model behind marking help, drafting and the safety checks. A person's name is replaced before any request is sent. | Where: United States | Only for a centre that chooses to run on XTutio's account, and as the backup when Australian AI hosting cannot answer |
| Resend | Sends and receives a centre's email. | Where: Tokyo, Japan, for sending domains XTutio sets up | Only for a centre that chooses to run on XTutio's account |
| LiveKit | Carries the video and sound of online lessons and staff meetings. | Where: Not yet confirmed | Only for a centre that chooses to run on XTutio's account |
| ElevenLabs | Live captions in calls, and an optional read-aloud voice. | Where: Not yet confirmed | Only for a centre that chooses to run on XTutio's account |
| Google Maps Platform | Places home-lesson addresses on a map, works out travel times and suggests addresses as they are typed. | Where: Not yet confirmed | Only for a centre that chooses to run on XTutio's account |
| Airwallex | Takes families' payments into the centre's own Airwallex account, opened under XTutio's platform account. | Where: Not yet confirmed | Only for a centre that takes family payments through Airwallex |
| Web Push services (Google, Apple, Mozilla, Microsoft) | Deliver phone and browser notifications to a parent's or staff member's own device. The notification is encrypted for the device, so the service cannot read it, and its words never name a child. | Where: Not yet confirmed | Only for a centre that switches phone notifications on, to people who turn them on |
| Cloudflare Turnstile | Checks a public form is filled in by a person, from the device's internet address and browser signals. | Where: Not yet confirmed | On public sign-up and join forms where it is switched on |
| Google reCAPTCHA | Checks a public enrolment form is filled in by a person, from the device's internet address and browser signals. | Where: Not yet confirmed | On a centre's public enrolment form where it is switched on |
| Microsoft 365 (XTutio's own mailbox) | Receives XTutio's own email: demo requests, support and privacy questions sent to hello@xtutio.com. | Where: Not yet confirmed | When someone writes to XTutio or asks for a demo |
| GitHub Actions | Runs the nightly backup and the monthly restore test, which read the database while they run. | Where: Not yet confirmed | Once backups are switched on |
| Amazon Web Services (Amazon S3) | Holds the encrypted nightly backups, kept 90 days. | Where: Sydney, Australia | Once backups are switched on |
| jsDelivr | Delivers code the browser downloads for the coding activities and the camera background effects; it sees the device's internet address. | Where: Not yet confirmed | When someone uses those features |
| Datamuse | Looks up word definitions in Quick tools; it receives the word and the device's internet address. | Where: Not yet confirmed | When someone looks up a word |
Services your centre connects itself
Your centre connects these with its own account, so they are your centre's arrangement with the provider. Nothing goes to one your centre has not connected.
| Service | What it does | Where | When it is used |
|---|---|---|---|
| Twilio | Text messages and phone calls from the centre's own number. | Where: Not yet confirmed | Only if the centre connects it |
| Stripe | Family payments on the centre's own Stripe account, where XTutio allows it. | Where: Not yet confirmed | Only if the centre connects it |
| Pinch Payments | Family direct debits on the centre's own Pinch account, where XTutio allows it. | Where: Not yet confirmed | Only if the centre connects it |
| HubSpot | The centre's own customer records. | Where: Not yet confirmed | Only if the centre connects it |
| Teachworks | Brings the centre's families, students, tutors and lessons across from Teachworks. | Where: Not yet confirmed | Only if the centre connects it |
| Xero | Sends the centre's invoices and payments to its own Xero. | Where: Not yet confirmed | Only if the centre connects it |
| Microsoft Teams | Lessons in the centre's own Microsoft Teams. | Where: Not yet confirmed | Only if the centre connects it |
Who can open what
Only the right people see a child's records: locked by the database, written down first.
Centres are kept apart by the database
Sharing software with other centres must never mean sharing families. Every record carries the centre it belongs to, and the database's own rules refuse a read or a change from another centre. A check in our build refuses any new rule that forgets it.
Two-step sign-in
A stolen password should not open a centre's families or money. Owners, admins and finance staff must use an authenticator app, and your centre can require it of every staff member. Each person has 14 days to set it up, then every page and action asks for it. Making or approving a pay run, or changing a pay rate, needs it whatever the grace period. Recovery codes are stored only as fingerprints.
Each role, in plain words
Admins give too much access when they cannot tell what a permission does. Every permission says what it unlocks, and the ones that reach private details, money or pay are marked. Your owner and the admins who manage staff can change a role for your centre or one person's access, never beyond what they hold themselves, never their own, and only with two-step sign-in. Each change is recorded before it is made.
Sign-in attempts are limited
Repeated wrong passwords slow down from the third try and stop after the sixth, and a burst of failed sign-ins alerts us and your admins.
Sensitive actions are written down first
When something goes wrong, owners need to show who did what. Switching off a staff sign-in or closing a child's account is recorded before it happens, and stops if the record cannot be written. Every data export is recorded, and risky actions alert us and your admins.
Platform staff need a reason
XTutio staff open a centre only to support it, give a reason each time, and every visit is recorded.
Keys are encrypted
The keys a centre saves for its connections are encrypted before they are stored, and no screen or API ever shows one again.
- Changed a rolePriya N. · Tutor to admin9:41 am
- Opened your centreXTutio support · Reason: help with the invoice run9:12 am
- Exported familiesSam K. · Two-step sign-in checked firstYesterday
- Reset two-step sign-inPriya N. · For Alex T., at your campusYesterday
Backups and leaving
Not locked in: a copy every night, and your data when you go.
Nightly encrypted backups
Every night the database and stored files are copied to storage in Sydney, encrypted before they are written, and each copy is kept for 90 days where the backup job itself cannot delete or overwrite it. Once a month a copy is restored and checked against what it should hold.
If your centre leaves
Ask for a copy of your centre's data and you have it within 30 days. After a centre closes its account its information is kept until the centre deletes it or for as long as the law requires; nothing is deleted on a timer. Child safety records are kept and are not deleted on request. Financial records are kept for 7 years because tax law requires it.
Last night
Database and files · encrypted
2 nights ago
Database and files · encrypted
3 nights ago
Database and files · encrypted
Each copy kept 90 days
Child safety
Safety has a page of its own.
The AI checks, working with children checks at every booking, parents on every channel and home visit safety are set out on the safety page.
Read about child safetyReport a security issue
Found a problem? Tell us.
If you think you have found a security problem in XTutio, email us with what you found and how to see it. A person reads every report, and we will tell you what we did about it. Please do not test against a centre's real data.
hello@xtutio.comLast updated 17 October 2026
In short
Security and data
XTutio stamps every record with the centre it belongs to and the database keeps other centres out. Staff sign in with two steps, sensitive actions are written down before they happen, and every outside service XTutio uses is listed. Your records and files are stored in Sydney, Australia. Email goes out through our email provider, live video travels through our video provider's servers, and AI requests may be processed outside Australia.
Questions centres ask
Can another centre see our data?
No. Every record carries its centre, and the database refuses another centre's reads.
Do staff need two-step sign-in?
Owners, admins and finance staff must use it, and a centre can require it of all its staff.
Where is our data stored?
Your records and files are stored in Sydney, Australia. Email goes out through our email provider, live video travels through our video provider's servers, and AI requests may be processed outside Australia.
