Data Protection Impact Assessment (DPIA)
Input from Graidable for the institution's own DPIA (GDPR Art. 35). The institution (controller) is responsible for the final, approved assessment. Not legal advice.
1. Summary
Graidable reads students' work, sorts it to students, and makes draft assessments and feedback that the teacher reviews and approves. The processing involves AI-based evaluation of individuals, possibly children, and potentially large volumes of data, so a DPIA is required or recommended.
Storage, reading and the AI models that assess the work run in the EU. Two parts run in the USA: every AI request passes through OpenRouter, and the sorting model Jev (TypeSafe) receives students' names and the text of their work (section 2). Every AI request is pinned in code to zero-retention endpoints whose providers do not store or train on it. The teacher decides every result.
Graidable's own estimate of the residual risk, with the measures below, is low to moderate. The institution makes the final assessment.
2. Description and data flow
- Upload. The teacher uploads the class list, their own files (task, answer key, criteria, class material) and students' work. Stored in AWS S3 (eu-west-1) and the database (Railway, EU).
- Reading. Scanned pages, and typed pages with maths or pictures, are read by LandingAI on its EU host (eu-west-1).
- Sorting (USA). Jev, run by TypeSafe in the USA and reached through OpenRouter (USA), gets the file name and the text of the pages and proposes what each page is and whose work it is. To match work to students it gets the assignment's class list with each student's full name, student number and candidate label. A match it is sure of is placed as the AI's proposal; one it is unsure of goes to "Not sure whose". The teacher can move any page.
- Questions and criteria (EU). GPT-6 Luna on Microsoft Azure in the EU (fallback: Gemini 3.5 Flash Lite on Google Vertex AI in the EU), through OpenRouter, drafts the questions, criteria and answer key from the teacher's files. No students' work. The teacher approves the criteria.
- Grading (EU). The same models, through OpenRouter, grade one student at a time against the approved criteria. They get the text of that student's pages, with the lines holding the student's name removed, and the page images, which can show a handwritten name. They do not get the class list or the file name.
- Review. The teacher reviews each draft, changes what they disagree with and approves it. Feedback PDFs are made only from approved results.
The final grade is set by the teacher; AI output is a draft only.
3. Purpose and legal basis
Purpose: more efficient, consistent assessment and feedback. The institution sets the legal basis (typically GDPR Art. 6(1)(e) public task, or (f) legitimate interest, or (a) consent). Processing at Graidable is on the institution's behalf under a DPA (Art. 28). Students' work may contain special-category data (Art. 9) in free text; see the risk table.
4. Data categories and subjects
About students: identifiers (name, and where the teacher adds them: email, student number, candidate label), their work (files, page images and the text read from them), and assessment data (points, draft and approved results, feedback). About teachers and teaching assistants: account, role and log data. When used in lower or upper secondary school, children's data is processed, which brings heightened requirements.
5. Sub-processors and transfers
| Sub-processor | Function | Location (configured) | Mechanism |
|---|---|---|---|
| Railway | App hosting, database (Postgres), queue (Redis/RabbitMQ) | EU – EU West (Amsterdam) | DPA + SCC (Railway is a US company; data stored in the EU) |
| AWS S3 | Storage | EU – eu-west-1 (Ireland) | DPA; EU region; encrypted at rest |
| AWS SES | Email to account holders | EU – eu-west-1 (Ireland) | DPA; no students' work |
| LandingAI (ADE) | Reading pages (OCR) | EU – eu-west-1 (Ireland) | DPA |
| OpenRouter | Passes every AI request to the model provider | USA | DPA + SCC |
| TypeSafe (Jev, via OpenRouter) | Sorting the files and pages to students | USA | Onward transfer by OpenRouter; zero data retention and no data collection required on every request |
| Microsoft Azure (GPT-6 Luna, via OpenRouter) | Questions, criteria and grading | EU (Azure EU) | Zero data retention and no data collection required on every request |
| Google Vertex AI (Gemini 3.5 Flash Lite, via OpenRouter) | The fallback model for the same steps | EU (Vertex AI EU) | Zero data retention and no data collection required on every request |
| Stripe | Payments | EU (Ireland) | No students' data |
Graidable chooses the AI models; there is no per-account policy. The routing is fixed in code for every AI request: only the endpoints listed above, no fallback to another provider, only endpoints OpenRouter lists as zero data retention, and only providers that do not store or train on the requests. A request with any other routing is refused before it is sent. Graidable calls TypeSafe, Microsoft and Google only through OpenRouter. Its code also lists Gemini 3.8 Flash on Google's global endpoint (outside the EU) as a grading model, used only in Graidable's own test runs and never on customers' data.
6. Necessity and proportionality
Data minimisation. Each AI step gets what its job needs (section 2):
- Finding questions and drafting criteria get only the teacher's files.
- Grading gets one student's work, with name lines removed from the text, but not from the page images.
- Sorting needs to match work to names, so Jev gets the class list with names, and the text of the pages.
The institution can reduce what is sent by using candidate labels or numbers in place of names, on the class list and on the work.
Retention. Data is kept while the class or account exists, with no automatic end date. Deleted classes and assignments are erased with their files after 30 days in "Recently deleted". Deleting the account erases its data at once. The AI providers keep nothing (zero data retention, required on every request).
7. Risk assessment
| # | Risk to the data subject | Likelihood | Impact | Measures |
|---|---|---|---|---|
| R1 | Unauthorised access | Low | High | Encryption in transit, files encrypted at rest, access control, EU hosting, logging |
| R2 | Transfer to a third country (USA): students' names and the text of their work to TypeSafe, and every AI request through OpenRouter | Medium | Medium | Zero retention and no data collection required on every request; no fallback to other providers; assessment models on EU endpoints; SCC |
| R3 | Use of data for model training | Low | High | Only providers that do not store or train on requests, required on every request; no training by Graidable |
| R4 | Re-identification | Medium | Medium | Name lines removed from the text sent for grading; candidate labels or numbers in place of names where the institution chooses. Names still reach Jev, and handwritten names can appear in page images |
| R5 | Inaccurate or biased assessment | Medium | High | Mandatory human review; the teacher approves every result; no automated grade |
| R6 | Fully automated decision (Art. 22) | Low | High | Output is a draft; the teacher decides |
| R7 | Sensitive data in free text (Art. 9) | Medium | Medium | Data minimisation; access restriction |
| R8 | Insufficient transparency | Medium | Medium | The institution informs students |
| R9 | Work sorted to the wrong student, so one student's work appears in another's result or feedback | Medium | Medium | Jev only proposes; unsure matches go to "Not sure whose"; the teacher sees the pages when reviewing and can move them; feedback PDFs are made only from approved results |
| R10 | A student writes instructions to the AI in an answer (prompt injection) to raise their mark | Medium | Medium | The grade is a draft the teacher reviews, changes and approves; nothing reaches the student without approval |
| R11 | Data kept longer than needed: there is no automatic end date, and the data sits in the teacher's own account | Medium | Medium | Recently deleted erases after 30 days; account deletion erases at once; deletion on request. The institution should set a deletion routine for its teachers |
8. EU AI Act
AI that evaluates learning outcomes is high-risk (Annex III). Human oversight is built in (draft output, the teacher decides); students are informed by the institution; this DPIA input, the DPA and the sub-processor list document the processing; the system performs no emotion recognition or biometric categorisation. The institution is the deployer.
9. Conclusion
Graidable's estimate is that, with these measures, the residual risk is low to moderate. This rests on human review of every result, zero retention and no data collection at every AI provider, and EU endpoints for the models that assess the work. It is weighed against the transfer of students' names and work text to TypeSafe in the USA and of every AI request through OpenRouter (R2). Final approval rests with the institution and its DPO.