# Hosting an edtech app with student data in Europe: what the rules ask in 2026

Last updated: 2026-11-10

Student data in Europe falls under the GDPR, which treats children as people who merit specific protection. In practice that means a processing agreement with each school, a data protection impact assessment that will very likely be needed, strict data minimisation, and parental consent only in the narrow case where you sell directly to a child and rely on consent. For hosting, pick a European provider that signs an Article 28 agreement and publishes its subprocessors: **Scalingo** or **Clever Cloud** if you want the app and a managed database certified to ISO 27001 in one place, **Eurobase** if your app layer is a web framework and you bring your own European database.

This guide isn't legal advice. Schools, education ministries and national regulators can add their own conditions, so read your customer's contract first.

## The requirements at a glance

| Requirement | Where it comes from | What it means for your hosting |
|---|---|---|
| Specific protection for children | GDPR Recital 38 | Less profiling, no marketing use, plain-language notices |
| A processing agreement with the school | GDPR Article 28 | Your host must sign the same kind of agreement with you |
| A legal basis that isn't legitimate interest for a school | GDPR Article 6(1) | Schools usually rely on a public task, so you act on their instructions |
| Parental consent below 16, or 13 to 16 by country | GDPR Article 8 | Only when you offer the service directly to a child on consent |
| A data protection impact assessment | GDPR Article 35, WP29 guidance | Children count as vulnerable, which pushes most edtech over the line |
| Privacy by design and by default | GDPR Article 25 | Collect less, keep it shorter, keep profiles private by default |
| High-risk rules for some AI | EU AI Act, Annex III point 3 | Admissions, grading, level placement and exam proctoring |

The legal text is from the GDPR and the AI Act as published, read on 10 November 2026.

## Who is the controller

Most edtech sells to schools. The school decides why pupil data is processed, so it's the controller, and you're its processor. That has three consequences.

- **The school chooses the legal basis.** Article 6(1) says legitimate interest can't be used by public authorities performing their tasks, and it names children as people whose interests weigh heavily against it. A public school will usually point to a task in the public interest instead.
- **You sign an Article 28 agreement.** It must say what you process, for how long, and that you act only on the school's documented instructions. Our [DPA checklist](/i/data-processing-agreement-checklist) covers the clauses.
- **Your host becomes your subprocessor.** Everything you promise the school about location, security and deletion has to hold for your hosting provider too. See [subprocessors explained](/i/subprocessors-explained).

If you sell straight to families or to students themselves, you're the controller. Then Article 8 applies whenever you rely on consent: below 16, a parent must give or authorise it, and each EU country may lower that age, but not below 13. You also have to make reasonable efforts to check that a parent really consented.

## What the school will ask you

- **A data protection impact assessment.** Article 35 requires one when processing is likely to bring a high risk. The WP29 guidelines list data about vulnerable people, children among them, as one criterion, and say that meeting two criteria usually means a DPIA. Large numbers of pupils, or scoring their work, can add a second.
- **A named contact for data protection.** Article 37 requires a data protection officer for public authorities and bodies, so a public school usually has one, sometimes shared with other schools, and will expect a contact on your side too.
- **Plain-language notices.** Article 12 asks for clear, plain language, in particular for information addressed to a child.
- **Minimal data by default.** Article 25 says only what's needed for each purpose should be processed by default, and that profiles shouldn't be visible to an unlimited audience without the person's action.
- **Proof of where data lives.** Location isn't strictly required by the GDPR, but schools often write it into tenders. Map the app, the database, file uploads, logs, backups and email. Our [EU-only SaaS plan](/i/saas-hosting-eu-data) goes layer by layer.

## When AI is part of the product

Annex III of the AI Act lists four education uses as high-risk: deciding admission or assignment to an institution, evaluating learning outcomes, assessing the level of education someone will get, and detecting cheating during tests. If your product does any of these, the high-risk obligations apply on top of the GDPR. The application dates for Annex III have been amended, so check the current text before you plan around a date. A tutoring chatbot that doesn't grade or decide isn't on that list, though the GDPR still applies to every prompt a pupil types.

## Where to host it

### 1. Scalingo

Scalingo SAS is based in Strasbourg and hosts both your app and its managed database. Its homepage lists ISO 27001 certification, an HDS option for health data and an Outscale SecNumCloud region.

- **Best for:** teams that want app, Postgres and a certificate they can hand to a school in one contract.
- **Price:** a 256 MB container from €7.20 a month excl. VAT, and PostgreSQL from €7.20 a month excl. VAT for 512 MB and 10 GB, with daily backups and point-in-time recovery. €8.64 in the SecNumCloud region, also excl. VAT.

### 2. Clever Cloud

Clever Cloud's PostgreSQL page says data is hosted in France and that the company is certified to ISO/IEC 27001:2022 and HDS. It offers managed PostgreSQL 14 through 18 with daily backups, and a DPA is available.

- **Best for:** edtech that sells to public bodies asking for certified hosting in France.
- **Price:** set by instance size and count, with free credits when you sign up; database prices come from its calculator.

### 3. Eurobase

Eurobase runs web apps, Functions, file storage and logs on European infrastructure run by Scaleway, a French provider, and the business is registered in Warsaw, Poland. Next.js, Nuxt, Astro and similar frameworks run on V8 isolates, and servers in Node.js, Python, Go and other languages run as containers. A Worker can keep data in D1-compatible SQLite. For pupil records in Postgres, connect a European database such as Scalingo's or Clever Cloud's from a container.

- **Best for:** the app and file layer of an edtech product, at a price a school pilot can predict.
- **Price:** a Free plan, then €10 or €20 a month + VAT for the workspace. Nothing is billed by usage today: work over a limit is refused, apps on V8 isolates and Functions stop until the monthly reset, and containers and static sites keep serving.
- **What it lacks:** managed Postgres, MySQL or Redis, preview deployments and Dockerfile builds. ISO 27001 and SOC 2 are still being worked on, so a tender that demands a certificate today rules it out. GitHub and GitLab Inc. are US subprocessors if you connect them; Codeberg keeps your code in Europe.

Eurobase signs a [DPA](/legal/dpa) and lists its [subprocessors](/legal/subprocessors). Project access logs hold visitor IP addresses and can be deleted 30 days after they're recorded, as the [retention table](/legal/privacy#retention) explains. Keep pupil names out of URLs so they don't end up in those logs.

## How to get ready

1. Write down who the controller is for each customer type: school, family or adult learner.
2. List every field you store about a pupil and drop the ones the product doesn't need.
3. Draft the DPIA with the first school, since it's their duty and your facts.
4. Put your host's DPA and subprocessor list next to the one you give schools, and close the gaps.
5. Check whether any feature grades, places or proctors students, and if so read Annex III.

## Frequently asked questions

### Does the GDPR set an age of consent for edtech apps?

Article 8 sets 16, and each country may lower it to as little as 13. It only applies when you offer the service directly to a child and rely on consent. When a school uses your app for teaching, the school's legal basis applies instead.

### Do I need a DPIA for a school app?

Very likely. Children are a vulnerable group in the WP29 guidance, and two criteria usually trigger a DPIA. The school, as controller, carries it out, and you supply the technical facts.

### Can student data be hosted outside the EU?

The GDPR allows transfers with an adequacy decision or safeguards such as standard contractual clauses. Many schools still ask for European hosting in their contract, so check the tender before you choose. See [Schrems II explained](/i/schrems-ii-explained).

### Is an AI tutor high-risk under the AI Act?

Not because it's a tutor. Annex III targets AI that decides admission, evaluates learning outcomes, sets a student's level or watches for cheating in tests. A tutor that grades work could fall under the second point.

### Does my hosting provider need ISO 27001?

The GDPR doesn't require it, but certification can help show the guarantees Article 28 asks for, and many school tenders list it. Scalingo and Clever Cloud state it today; Eurobase doesn't hold it yet.

## Sources

- [GDPR Article 6](https://gdpr-info.eu/art-6-gdpr/), [Article 8](https://gdpr-info.eu/art-8-gdpr/), [Article 12](https://gdpr-info.eu/art-12-gdpr/), [Article 25](https://gdpr-info.eu/art-25-gdpr/), [Article 35](https://gdpr-info.eu/art-35-gdpr/), [Article 37](https://gdpr-info.eu/art-37-gdpr/), [Recital 38](https://gdpr-info.eu/recitals/no-38/) and [Recital 75](https://gdpr-info.eu/recitals/no-75/)
- [GDPR on EUR-Lex](https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng)
- [WP29 Guidelines on data protection impact assessment, WP248 rev.01](https://ec.europa.eu/newsroom/article29/items/611236)
- [AI Act Annex III, high-risk AI systems](https://artificialintelligenceact.eu/annex/3/)
- [Scalingo](https://scalingo.com/) and [Scalingo PostgreSQL](https://scalingo.com/databases/postgresql)
- [Clever Cloud PostgreSQL](https://www.clever.cloud/product/postgresql/) and [Clever Cloud pricing](https://www.clever.cloud/pricing/)
- [Eurobase pricing](/pricing), [Eurobase DPA](/legal/dpa), [Eurobase subprocessors](/legal/subprocessors) and [Eurobase privacy and retention](/legal/privacy#retention)