Our Subprocessors
Last updated: July 30, 2026
Principles
Student exam papers are automatically redacted (removal of names and direct identifiers) upon import; the redacted version is used for most of the processing by the AI models, and transmissions of the original version are limited to the minimum necessary (in particular for detecting the elements to be masked).
No training and limited retention: all AI model providers contractually commit not to use the submitted content to train their models. They may retain it for a limited period (zero to 55 days depending on the provider) solely for security and abuse-detection purposes, then delete it; this period may be extended for content flagged as abusive.
Persistent data storage (database, files) is located in the European Union / EEA.
Each subprocessor established outside the EU is governed by an Art. 28 DPA and a valid transfer mechanism (EU-U.S. Data Privacy Framework certification and/or Standard Contractual Clauses).
Infrastructure subprocessors
Provider | Role | Company (country) | Data location | Data concerned | Safeguards |
|---|---|---|---|---|---|
Backblaze, Inc. | File storage (exam papers, scanned pages) | USA | EU (Netherlands) | Student exam papers, exam questions | DPA + DPF certification + SCCs |
PlanetScale, Inc. | Database | USA | EU (Germany), including backups | Transcriptions, grades, accounts | DPA + SCCs |
Vercel, Inc. | Application hosting and server functions | USA | EU (France, Germany) | Data transiting during processing | DPA + DPF certification |
Trigger.dev (API Hero Ltd) | Background processing orchestration | United Kingdom | EU (Germany) | Content transiting in processing memory | DPA + EU-UK adequacy decision |
Stripe, Inc. | Payment | USA | EU, USA | Teachers' billing data (never student data) | DPA + DPF certification |
PostHog, Inc. | Product analytics | USA | EU (Germany) | Product events (no student data) | DPA + EU hosting |
Hetzner Online GmbH | Image resizing proxy | Germany | EU (Germany) | Page images in transit | DPA (no transfer outside the EU) |
Cloudflare, Inc. | Voice transcription proxy (upcoming feature) | USA | Global Cloudflare network | Teacher dictation audio in transit (never student data) | DPA + DPF certification + SCCs |
Pipedrive OÜ | Customer relationship management (CRM) | Estonia | EU (Germany, Ireland) | Business contacts and prospects (never student data) | DPA + DPF adherence for its US subprocessors |
Brevo SAS | Newsletter sending | France | EU | Email addresses of registered users | DPA (no transfer outside the EU) |
Intercom R&D Unlimited Company | Customer support and messaging | Ireland | EU (Dublin, Ireland — AWS eu-west-1) | Support conversations with users | DPA + RDH Addendum |
AI model providers
Submitted content undergoes automatic redaction - transmissions of the non-redacted version are limited to the minimum necessary (in particular for detecting the elements to be masked). Each provider contractually commits to not using the content to train its models, a commitment that applies to all content, redacted or not; retention is limited to abuse detection (zero to 55 days depending on the provider, extendable for flagged content), after which the content is deleted.
Provider | Role | Company (country) | Safeguards |
|---|---|---|---|
Mistral AI | Language models | France | DPA + EU hosting by default + no training (paid API); retention limited to 30 days (abuse detection) |
Anthropic, PBC (Claude) | Language models | USA | DPA (SCCs included) + no training; retention limited to 30 days (abuse detection, extended in case of flagging) |
OpenAI, L.L.C. | Language models | USA | DPA (SCCs) + no training; retention limited to 30 days (abuse detection) |
Google LLC (Gemini) | Language models | USA | DPA + DPF certification + no training (paid offering); retention limited to 55 days (abuse detection) |
OpenRouter, Inc. | Routing to open models for certain technical processing | USA | DPA (SCCs included) + restriction to "zero retention" endpoints |
Cerebras Systems Inc. | Language models | USA | DPA (SCCs included) + no training; inputs and outputs are not retained after processing |