Data and infrastructure
Last updated November 10, 2026
Our platform uses multiple cloud providers and subprocessors to run Flat for Education. To provide the best performances, security, and service, these providers and datacenters are located in multiple countries. We also replicate data across multiple countries.
Domain names
If you're using restrictive firewall or proxy server settings, you or your network admin will need to allow (whitelist) certain domains to ensure Flat for Education and related services work as expected.
Allow these domains for Flat for Education and related services provided by our company:
https://*.flat.io
https://*.flat-cdn.com
https://*.flat-embed.com
Infrastructure providers
Flat uses the following providers for its production infrastructure:
| Provider & Entity Country | Hosting Country |
|---|---|
| Amazon Web Services Inc. (US) | US |
| DigitalOcean LLC. (US) | US, GB, NL |
| OVH Limited (UK) | CA, GB, FR |
| Wasabi Technologies LLC (US) | US, NL |
| Cloudflare, Inc. (US) | Worldwide |
| Modal Labs, Inc. (US) | Worldwide |
Subprocessors
Subprocessors that process student data
These subprocessors have access to student data as part of providing our core service:
| Subprocessor Name | Service | Usage and Country |
|---|---|---|
| Amazon Web Services (Amazon Web Services EMEA SARL, Luxembourg) | IaaS provider | We use Amazon Web Services for their data storage and email service (in the US). |
| DigitalOcean LLC. | IaaS provider | We use Digital Ocean for their compute and data storage (in the US, the UK and the Netherlands). |
| OVH (OVH Limited, UK) | IaaS provider | We use OVH for cloud instances, storage and object storage (in Canada, the UK, France). |
| Wasabi Technologies LLC | IaaS provider | We use Wasabi for their data storage (in the US and the Netherlands). |
| Cloudflare, Inc. | IaaS provider | We use Cloudflare for their CDN, which serves files uploaded by users, and for R2 storage of audio exports and CDN content (Worldwide). |
| Google (Google Cloud EMEA Limited, Ireland) | PaaS/SaaS provider | We use Google for G Suite, Google Cloud (including Cloud Translation for assignment text), Firebase and reCAPTCHA. |
Subprocessors that do NOT process student data
These subprocessors only process admin and teacher data - they have NO access to student data:
| Subprocessor Name | Service | Usage and Country |
|---|---|---|
| HubSpot (HubSpot UK Holdings Limited, UK) | SaaS provider | We use HubSpot for our support tool and to send communication by email. Student data might be processed if you send us student information by email. |
| Peaberry Software Inc. DBA Customer.io | SaaS provider | We use Customer.io to send communication by email and in-app. |
| Mixpanel, Inc. | SaaS provider | We use Mixpanel for internal product analytics (in the Netherlands, EU). Most analytics are pseudonymized. |
| Stripe (Stripe Payments Europe Limited, Ireland, and Stripe, Inc., US) | Payment provider | We use Stripe to process payments on the platform. |
| Xero (UK) Ltd. | SaaS provider | We use Xero for the accounting and invoicing of our company. |
| Modal Labs, Inc. | IaaS provider | We use Modal Labs for GPU compute that reads sheet music you import. Only the pages a teacher imports (and text extracted from them) are sent, never account or student records. Pages, results and processing logs are processed worldwide and kept by Modal in the US for up to 7 days. Transfers rely on Modal's DPA. |