To evaluate whether an AI tool keeps student data onshore, ask the vendor exactly where data is stored and processed, request their subprocessor list and cloud region details in writing, and confirm the contract restricts overseas access. Verify claims against documentation rather than marketing statements.
What does keeping student data onshore actually mean?
Keeping student data onshore means the personal information students generate is stored and processed within a defined jurisdiction rather than sent overseas. In a New Zealand context, teachers usually mean information that stays inside New Zealand, though some vendors use ‘onshore’ loosely to describe the wider Australasian region. The distinction matters, so it is worth pinning down what a supplier actually promises before you rely on it.
Two related ideas often get blurred. Data residency describes where information physically lives, while data sovereignty describes whose laws and interests govern it. A tool can store data in a local data centre yet still route it through overseas systems for support or model processing, which affects sovereignty even when residency looks local. Ask which of these a claim refers to before you accept it at face value.
It also helps to separate the marketing word from the technical reality. Many cloud platforms serve New Zealand from Australian data centres, so a tidy ‘onshore’ badge can quietly mean the Tasman region rather than New Zealand itself. Neither option is automatically wrong, but you cannot weigh the choice until you know which one you are actually being offered.
Why does data residency matter for New Zealand schools?
Data residency matters because schools remain accountable for student information under the Privacy Act 2020, even when a third-party tool holds it. The Act treats a school as an agency responsible for how personal information is collected, stored, used and disclosed. Choosing where that data sits is part of meeting those obligations, not a technical afterthought handled quietly by a supplier.
Information Privacy Principle 12 specifically covers sending personal information outside New Zealand. In broad terms, a school should only rely on an overseas provider when comparable privacy safeguards apply. Student data is also sensitive: it can include names, ages, assessment results and written work that reveals a great deal about a child, so the bar for careful handling is high.
There is a trust dimension too. Whānau and communities increasingly ask where their children’s information goes, and many place particular importance on Māori data sovereignty. Being able to answer clearly, backed by Ministry of Education guidance on using digital technologies safely, protects both students and the school’s relationship with its community.
Which questions reveal where an AI tool really stores data?
The questions that reveal the truth are specific and location-based, because vague reassurance is easy to give. Instead of asking whether data is safe, ask exactly where it is stored, where it is processed, and who can access it from which country. A supplier confident in its setup can answer these quickly and in writing.
Work through a consistent set of questions for every tool you assess so that comparisons stay fair and defensible.
- In which country and region is student data stored at rest?
- Where is the data processed, including any AI model calls?
- Which third parties or subprocessors touch the data, and where are they based?
- Can support staff outside New Zealand access student information, and under what controls?
- How and when is data deleted when we stop using the tool?
How do you tell storage location from who can access the data?
Storage location and access are different questions, and a tool can pass one while failing the other. Data might rest on a server in New Zealand or Australia yet still be readable by engineers, support teams or AI providers based elsewhere. Residency tells you where the files sit, while access tells you who can actually see the contents, which is often the more important privacy question.
AI tools add a specific wrinkle: the model that generates feedback may be operated by a separate provider in another country. When student work is sent to that model, it crosses a border even if the main database stays local. Ask whether prompts and student text are sent to external model providers, whether that content is retained, and whether it is used to train models.
A useful habit is to map the full journey of a single piece of student writing, from the moment it is uploaded to the moment feedback returns. Note every system it passes through and every party that could read it along the way. That path, rather than a headline claim about storage, is what genuinely tells you whether a tool keeps student information where you expect it to stay.
What written evidence should you ask a vendor to provide?
Ask for written evidence rather than verbal assurances, because a claim you cannot see documented is hard to hold anyone to. Reputable suppliers expect these requests and can usually supply them without fuss. Keep the responses on file so you can show your process if a parent, board or reviewer ever asks how the decision was made.
If a vendor cannot produce these, treat that as a finding in itself. An inability to describe its own data flows is a stronger signal than any marketing page, and it hints at how a real incident might be handled.
- A data processing agreement setting out storage location and permitted uses
- A current list of subprocessors and the countries they operate in
- Documentation of the cloud region where data is hosted
- The breach notification process and its timeframes
- A clear data deletion and export policy for when you leave
How can you apply consistent criteria without losing control?
Applying consistent criteria means using the same checklist for every tool and keeping a human decision at the centre. Data residency is one lens; you also want to know that a tool supports your teaching rather than replacing your judgement. The strongest position is one where you understand where information goes and you still control the output.
This is how we think about JeddAI, built in Australia and used across Australia and New Zealand. It drafts feedback and marking aligned to your own rubric, success criteria and comment banks, then hands control back to you to review and edit, so professional judgement stays with the teacher. Apply the same residency questions here that you would to any supplier. Get started with JeddAI and keep your marking consistent while you stay in control.
| Signal | Stronger data residency | Weaker or higher risk |
|---|---|---|
| Storage location | Stated country and region, documented | Vague 'the cloud' with no location given |
| Processing and AI models | Discloses where models run and whether text is retained | Cannot say where student text is processed |
| Subprocessors | Current list with countries, updated as they change | No list, or unwilling to share one |
| Contract terms | Written data processing agreement with residency clauses | Assurances given verbally only |
| Deletion and breach | Clear deletion, export and breach-notification process | Undefined retention and no breach timeframe |
| Transparency | Answers specific questions quickly and in writing | Redirects to marketing language |
Frequently asked questions
Is data stored in Australia considered onshore for New Zealand?
Not strictly. Australian storage is offshore from a New Zealand point of view, though it is often treated as lower risk than storage further afield. Confirm whether a vendor's 'onshore' claim means New Zealand or the wider Australasian region.
Does the Privacy Act 2020 ban sending student data overseas?
No. It permits overseas disclosure when comparable safeguards apply or other conditions are met under Information Privacy Principle 12. The school stays accountable for checking those safeguards exist.
What is the difference between data residency and data sovereignty?
Residency is where data physically lives, while sovereignty is whose laws and interests govern it. A tool can meet residency expectations yet still raise sovereignty questions if overseas parties can access the data.
Do AI feedback tools send student work to overseas model providers?
Some do, because the underlying model may be run by a separate provider abroad. Ask specifically whether student text leaves the country, whether it is retained, and whether it is used for training.
Who is responsible if an edtech vendor mishandles student data?
The school remains accountable as the agency under the Privacy Act 2020, even though the vendor processes the data. That is why documented contracts and clear data flows matter.
Get started with Jeddle
Jeddle gives teachers and students instant, syllabus-aligned feedback powered by JeddAI.
Looking for study material? Browse Jeddle's Australian-English subject resources, or explore more articles on EdTech & Tools.
