Privacy

Kublio sub-processors

These are the organisations that may handle data on AirbourneIT's behalf when a school uses Kublio Cloud. Each one is named below with what it does, what data it may handle, the basis on which it is disclosed, and the countries in which it may be processed.

Version 2.4. Last updated 1 November 2026. AirbourneIT Pty Ltd (ABN 68 641 157 191), Western Australia. Privacy enquiries: info@kublio.com.au. Reviewed every six months, and on adding or changing any sub-processor; next review 11 March 2027.

Kublio Server

Kublio Server has no sub-processors. The School's own server runs everything and holds the School's data, on the School's own network. The only thing it sends to AirbourneIT is a periodic licence check-in, which is information about the machine and not about any person.

Sub-processors for Kublio Cloud

OVH Australia Pty Ltd

Organisation: OVH AUSTRALIA PTY LTD (ABN 61 612 612 754), an Australian subsidiary of OVH Groupe SA, a French company
Contact: https://www.ovhcloud.com/en-au/
Purpose: Hosting. OVH supplies two dedicated servers in Sydney. On the first, Kublio Cloud runs as three private virtual machines: the application at my.kublio.com.au, the licence service, and the shared VR room server at room.kublio.com.au, which runs a world a student has shared to a VR headset. The second holds a second copy of Kublio Cloud's nightly backups. OVH also supplies network-level protection against denial-of-service attacks, which does not decrypt or inspect connections. It is the place Kublio Cloud data is stored.
Data types disclosed: Everything Kublio Cloud holds at rest: school records, display names, a school email address for each person, class membership, the value derived from a PIN, and User Content (the worlds, code and recorded sound a person creates). It is held on encrypted disks whose unlock keys are not held by OVH. The VR room server holds, in memory only and only while a shared world is open, that world's ground, where things stand and its program (including any words the student typed into it), and any first name a student types on a headset; it writes none of it to disk. The backup copy is encrypted before it reaches OVH's server, and OVH does not hold its key. OVH's network also carries the encrypted connections to the service and sees the IP address of every device that connects.
Lawful basis: Australian Privacy Principle 6. The disclosure is to a service provider engaged to deliver the service for the purpose the information was collected for, and OVH processes it only on AirbourneIT's instructions. AirbourneIT contracts with the Australian company and the server is in Australia.
Countries of processing: Australia for all storage and processing: two dedicated servers in Sydney, New South Wales. Under its contract, OVH may use companies in its group in the European Union, India, Canada, the United Kingdom and Singapore for hardware support and incident handling, and those staff can operate the server hardware, the network and the out-of-band management console. They cannot read Kublio Cloud data: every disk holding school data is encrypted, the keys are held on a separate key server in Australia that OVH does not control, and OVH holds no login to the operating system or the application.

OVH's certifications, including ISO 27001, are OVH's own. They are not a certification of Kublio or of AirbourneIT.

Binary Lane Pty Ltd

Organisation: Binary Lane Pty Ltd, an Australian company
Contact: https://www.binarylane.com.au/
Purpose: Key storage. Binary Lane supplies one small server in Sydney that holds the keys which unlock the encrypted Kublio Cloud disks at start-up. It is deliberately a different provider from the one holding the disks, so the keys and the data they unlock are never with the same company.
Data types disclosed: The disk unlock keys for Kublio Cloud only. No school records, no names, no User Content. Anyone holding a key without the disk it unlocks holds nothing readable.
Lawful basis: No personal information of a School or a person is disclosed to Binary Lane. It is listed because it holds the means of reading Kublio Cloud data, which a School is entitled to know. If personal information were ever disclosed, the basis would be Australian Privacy Principle 6, as for OVH above.
Countries of processing: Australia. One server in Sydney, New South Wales.

Until 16 September 2026 Binary Lane also supplied the servers in Perth on which Kublio Cloud data was stored. Those servers were retired on 16 September 2026.

Cloudflare, Inc.

Organisation: Cloudflare, Inc., a United States company
Contact: https://www.cloudflare.com/ , privacy enquiries at https://www.cloudflare.com/trust-hub/
Purpose: DNS only. Cloudflare answers the lookup that turns a Kublio address such as my.kublio.com.au into the address of the server. It does not carry, decrypt, inspect or cache any connection to Kublio Cloud: once a device has the address, it connects to the server in Sydney directly.
Data types disclosed: DNS lookups for Kublio host names, which carry the address of the DNS resolver asking. That is usually a school's or an internet provider's resolver rather than a person's device. No school data, no sign-in, and no page content passes through Cloudflare.
Lawful basis: No School information is disclosed to Cloudflare for this service, so Australian Privacy Principles 6 and 8 are not engaged by it. It is listed because it is the first service a device reaches on its way to Kublio Cloud.
Countries of processing: Cloudflare answers DNS lookups from its network worldwide. Cloudflare, Inc. is established in the United States.

Microsoft Corporation (Defender for Endpoint)

Organisation: Microsoft Corporation, a United States company, through AirbourneIT's own Microsoft 365 tenant
Contact: https://privacy.microsoft.com/
Purpose: Security monitoring. Microsoft Defender for Endpoint runs on the Kublio Cloud server and both of its virtual machines, looks for malicious software and suspicious activity, and reports what it observes to Microsoft so that alerts reach AirbourneIT.
Data types disclosed: Security telemetry about the servers: file and process metadata, such as the names and fingerprints of files and the programs that run, and alerts about what it detects. It is not intended to include school content. Whether it can, for example if a file on the server were sent to Microsoft for analysis, has not yet been assessed.
Lawful basis: Australian Privacy Principle 6, because the software is engaged to protect the service. Australian Privacy Principle 8 would also apply, because Microsoft processes the telemetry outside Australia. Whether any of that telemetry is personal information has not yet been assessed.
Countries of processing: United States.

Listed before its assessment is finished rather than after it. This entry will be revised when the assessment is done.

Microsoft Corporation (Microsoft 365 email)

Organisation: Microsoft Corporation, a United States company, through AirbourneIT's own Microsoft 365 tenant
Contact: https://privacy.microsoft.com/
Purpose: Sending email. Kublio Cloud sends its email through Microsoft 365, from AirbourneIT's own mailbox hello@kublio.com.au. It sends three kinds and no others: the email that lets a person set their password, the welcome to a new School's first teacher, and the confirmation of a trial request. None is marketing. A School's own Kublio server sends no email.
Data types disclosed: For each email, the recipient's email address and the message. A set-password email or a welcome contains the person's display name, the School's name, the address they sign in with and a link that sets a password once and stops working after seven days; a welcome also gives the number of students and teachers on the School's trial and when it ends. A trial confirmation contains the name and school typed on the sign-up page, a reference and a link that works for 72 hours. No class roll, no other person and no User Content is sent, and no copy is kept in the mailbox's sent items.
Lawful basis: Australian Privacy Principle 6. The disclosure is to a service provider engaged to deliver the email the service sends, for the purpose the address was collected for, and Microsoft handles it on AirbourneIT's instructions. If any of it is handled outside Australia, Australian Privacy Principle 8 also applies.
Countries of processing: Australia. Microsoft holds AirbourneIT's Microsoft 365 mailbox data in Australia. Each email is then delivered to the recipient's own mail service, wherever that is.

Google LLC

Organisation: Google LLC, a United States company
Contact: https://policies.google.com/privacy
Purpose: The public marketing website at kublio.com.au serves web fonts from Google and is configured to send browser error and content-security-policy reports to Google. This is the marketing website only. It is not the Kublio application and no student ever needs to visit it.
Data types disclosed: The IP address and user agent of a visitor to the marketing website, and the address of any page resource a browser refused to load.
Lawful basis: No contract exists with Google for this. It happens because the page instructs the browser to fetch from Google, and it is disclosed here for that reason rather than defended.
Countries of processing: United States.

This is being removed. The application, the teacher area and this repository's own marketing page already serve every font from AirbourneIT's own origin. The live marketing site is built on a separate hosting platform and is the last page still fetching from Google.

Cloudflare, Inc. (bot challenge on the marketing website)

Organisation: Cloudflare, Inc., a United States company
Contact: https://www.cloudflare.com/ , privacy enquiries at https://www.cloudflare.com/trust-hub/
Purpose: The public marketing website at kublio.com.au uses Cloudflare Turnstile to tell people from automated form spam. This is the marketing website only. It is not Kublio Cloud and no student ever needs to visit it.
Data types disclosed: The IP address and browser characteristics of a visitor to the marketing website, which Turnstile uses to decide whether the visitor is a person.
Lawful basis: Australian Privacy Principles 6 and 8, because Cloudflare is an overseas recipient. It happens because the marketing page loads Cloudflare's challenge, and it is disclosed here for that reason.
Countries of processing: Cloudflare's network worldwide. Cloudflare, Inc. is established in the United States.

What changed

16 September 2026: Kublio Cloud moved from servers in Perth, Western Australia, supplied by Binary Lane, to a server in Sydney, New South Wales, supplied by OVH Australia. The Perth servers were retired the same day. Binary Lane now holds only the keys that unlock the encrypted disks, on a separate server in Sydney.
16 September 2026: Cloudflare stopped carrying Kublio Cloud traffic. It no longer decrypts, inspects or caches any connection, and now answers DNS lookups only. The Cloudflare page analytics, error logging and page prefetching that version 1.0 of this page disclosed are no longer present on the hosted application.
17 September 2026: Microsoft is added, for the security software that runs on the Kublio Cloud servers.
24 October 2026: Microsoft is added for a second service, sending Kublio Cloud's email, and the description of what OVH holds now says that every person on Kublio Cloud has a school email address, not only those whose School signs in with Microsoft 365 or Google.
29 October 2026: the description of what OVH supplies now names the VR room server, a third virtual machine on the same server in Sydney, and what it holds. No new supplier is added.
29 October 2026: the countries line for OVH now names the countries from which OVH's own hardware and support staff may work on the server (the European Union, India, Canada, the United Kingdom and Singapore), and says why they cannot read school data. Nothing about where data is stored has changed: it is all in Sydney.
1 November 2026: OVH now supplies a second dedicated server in Sydney, which holds a second encrypted copy of the nightly backups. No new supplier is added.

Not sub-processors, and why

Named here because leaving them out invites the question.

Microsoft (Entra ID) and Google Workspace. These are the School's own identity tenants, under the School's own agreements with Microsoft or Google. A School that turns on single sign-on is using a service it already holds. AirbourneIT does not contract with either provider on the School's behalf and is not their customer for this purpose, so neither is a sub-processor of AirbourneIT for sign-in. Kublio receives an opaque sign-in identifier and, where the School provides one, a school email address. It never receives a password. Microsoft appears above for two different services, both under AirbourneIT's own Microsoft 365 tenant: the security software on the Kublio Cloud servers, and sending Kublio Cloud's email.
AirbourneIT's own backup storage. Kublio Cloud is backed up nightly. The backup is encrypted and pulled from the servers to storage that AirbourneIT owns and operates itself, in Perth, Western Australia, and a real file is restored and compared with the live server on every run. A second encrypted copy is kept on the second OVH server in Sydney, described under OVH above; OVH does not hold the key to it.
GitHub, Inc.. Source code hosting for AirbourneIT's own engineers. No personal information of any student or teacher is stored there, so it is a supplier rather than a sub-processor. It is recorded in AirbourneIT's internal provider register.
Replit. Not part of the Kublio solution. It is used for an unrelated internal system and has no Kublio data and no place in the hosted path.