Sub-processors
List version 2026-08-21
The providers that process personal data on our behalf when we run the platform for your organization. This list forms Annex III of the Data Processing Agreement.
| Provider | What they do | Where | Transfer safeguard |
|---|---|---|---|
| Google Cloud / Firebase | Hosting, database, file storage and sign-in | United States (us-central1) | EU–US Data Privacy Framework |
| Stripe | Subscription billing, school fees and donations | United States, European Union | Data Privacy Framework and Standard Contractual Clauses |
| PayPalOptional — your organization can turn this off | Subscription billing, school fees and donations | United States, European Union | Standard Contractual Clauses |
| Amazon Web Services (SES) | Sending email | United States (us-east-1) | Data Privacy Framework and Standard Contractual Clauses |
| AnthropicOptional — your organization can turn this off | The optional AI assistant. Your data is not used to train models | United States | Standard Contractual Clauses |
| TwilioOptional — your organization can turn this off | SMS notifications | United States | Data Privacy Framework and Standard Contractual Clauses |
| Google Analytics 4Only after you accept analytics cookies | Website analytics only — never your organization’s records | United States | EU–US Data Privacy Framework |
Changes to this list
We give customers at least 30 days’ notice before adding or replacing a sub-processor, and you may object on reasonable data-protection grounds. If we cannot resolve the objection, you may end the affected subscription and we refund the unused part.
History
- 2026-08-21 — First published list.