Public · Last updated July 21, 2026
Subprocessor List
Every vendor that touches service data, what it does, where it runs, and the agreement that binds it. Referenced from our Privacy Policy and NDPA exhibits.
| Subprocessor | Service | Purpose | Data categories | Location | Flow-down agreement |
|---|---|---|---|---|---|
| Microsoft Corporation | Azure App Service, Azure Database for PostgreSQL, Azure Blob Storage, Azure Communication Services | Hosting, database, file storage, transactional email delivery | All service data (encrypted in transit + at rest) | United States (Central US region) | Microsoft Products and Services DPA |
| Google LLC | Vertex AI (Gemini) | Teacher-invoked AI drafting and extraction | Content of the specific request (minimized where feasible); no training on customer data | United States (us-central1, Iowa — pinned in configuration) | Google Cloud Data Processing Addendum |
| Google LLC | Classroom API, Gmail/Workspace APIs | Roster/coursework sync; sending teacher-approved emails via teacher's account | Data covered by the teacher's OAuth grant (read-only Classroom scopes) | Google Workspace (LEA's own tenant) | Operates under the LEA's Google Workspace for Education agreement + teacher OAuth consent |
Notes
- No analytics, advertising, error-tracking, or session-replay vendors are used anywhere in the product (verified in code audit, July 2026).
- Change process: LEAs under agreement receive advance notice of any subprocessor addition or change; new subprocessors are bound to equivalent privacy, security, deletion, and breach-response terms before receiving any data.