Infrastructure and jurisdiction

This is an English translation. If it differs from the Spanish version, the Spanish version prevails.

What this page is for

It explains where each Coraula product's infrastructure is and under which jurisdiction it operates, and the measures we apply so that a government outside the European Union cannot access our customers' data or take it away in breach of EU or Spanish law. It is the information required by Article 28 of Regulation (EU) 2023/2854 (Data Act), and the General Terms of Service cite it in clause 10.

The providers that process personal data, with their country and safeguards, have their own page: "Providers that process data".

The infrastructure, product by product

Product	What it does and where	Jurisdiction
Coraula Central	The application, the database and uploaded files run on Arsys servers in Spain. The daily backups CRUD undertakes to make (clause 13 of the General Terms of Service) will also be kept there.	Spain (European Union)
Coraula Live	Live classes go through Arsys servers in Spain, which also record and process the sessions. Recordings that are played back are kept in Cloudflare R2 storage with European jurisdiction, which guarantees they are stored in European Union data centres. Downloads are generated in the browser from that same recording. The working copy of each recording, with each participant separately, is kept at Arsys, in Spain. R2 is contracted directly with Cloudflare, Inc., and the European jurisdiction guarantees where the recordings are stored, not where the requests to view them travel, which Cloudflare may process on its worldwide network.	Spain and European Union for storage. Cloudflare, Inc. is headquartered in the United States, and its data processing agreement provides for processing outside the European Economic Area, under the EU-U.S. Data Privacy Framework and, should it cease to apply, standard contractual clauses
Coraula Translate	The application and the projects are stored at Arsys, in Spain. The text being translated is sent to Microsoft's machine translation service (Azure Translator) through its European endpoint, which handles the request in Microsoft data centres in the European Union (its France Central and West Europe regions). The images being translated are sent to an artificial intelligence model through OpenRouter, Inc., in the United States, which passes them on to that model's provider.	Spain for storage and European Union for text translation. Image translation is not guaranteed to take place within the European Union: it is processed by OpenRouter and the model provider, outside it. That is why Translate, as a whole, cannot guarantee that all processing stays in the European Union
Coraula SCORM	Cannot be contracted within Coraula yet. This page will be updated when it can.

Services common to all products. Domain names are resolved by Cloudflare (DNS), which also provides the bot check on some forms (Turnstile); both run on its worldwide network. Platform emails are sent through the email service of Hostinger International Ltd., a Cypriot company that in turn uses providers, some of them American.

Measures against access by governments outside the European Union

No provider can promise that a foreign government will never ask for anything. What we do is this:

Technical

• Customer data is stored in Spain and, for recordings, in the European Union.
• Everything travels encrypted between your browser and the platform.
• Recordings are not public: they are only delivered through signed links valid for a limited time, so no link to a recording works permanently.
• Passwords, keys and secrets are stored encrypted or transformed so that they cannot be read.
• Access to the servers and the data is limited to the CRUD staff who need it, and is logged.

Organisational

• If an authority outside the European Union asked us for a customer's data, we would only hand it over when EU or Spanish law allows it, for example through an applicable international cooperation agreement.
• We would review each request, hand over only the minimum strictly necessary and tell the customer, unless the law prohibits us.

Contractual

• We prefer providers with infrastructure in the European Union, and with each one we choose the options that keep the data there where they exist, such as Cloudflare R2's European jurisdiction.
• Our providers are contractually bound to process our customers' data following our instructions. With one caveat worth knowing: Cloudflare's contract allows it to use the data generated by traffic on its network to maintain and improve its services, and in the bot check (Turnstile) it also uses the signals it collects to improve its detection, on its own account.
• Cloudflare's data processing agreement (section 8) requires it to notify us as soon as a third party, including a government, asks it for data it processes on our behalf, unless the law prohibits it; to tell the requester that it cannot hand the data over without our consent and, if it must, to disclose only the minimum; and, if a government request conflicts with another applicable law, to challenge it up to appeal before handing anything over. It publishes a transparency report on those requests every six months.

When this changes

If the jurisdiction of a product's infrastructure changes, we will publish a new version of this page. If the change affects where the data you have entrusted to us is stored, it is not a change to this page but to your contract, and we will tell you beforehand.