An AI tool teachers use daily isn't just a software purchase — it's a question of where your data goes, who can see it, and whether the system touches a child's future. Hand BBE Buddy to a DPO or board and the hard questions already have documented answers.
Application & database in Frankfurt, search index in Ireland. Encrypted at rest (AES-256) with built-in erasure.
No grading, tracking, admissions or exam monitoring. A limited-risk chatbot under the EU AI Act — not high-risk.
EU-resident model blend — sovereign Mistral + Azure-EU frontier — contractually no-training, with short or zero retention.
Every component, what it does, where it sits, and whether it stays in the EU. No surprises for your DPO.
| What it does | Where it runs | In the EU? |
|---|---|---|
| Application — assembles the answer | Vercel · Frankfurt | Yes |
| Database & login — all stored data | Supabase · Frankfurt | Yes |
| Search index — the teaching library | Pinecone · Ireland | Yes |
Moving the embedding / re-ranking hop to an EU provider is on the near-term roadmap — we say so plainly rather than imply it's already done.
The GDPR posture, the DPA, the EU AI Act classification and the EU-model paths are all written down — ready to hand to a board or a data-protection officer.
The full server map, the EU AI Act classification, the GDPR posture, the DPA and the EU-model paths are in the dedicated annex.
