Overview
SchoolIntel engages a small set of vendors (“Sub-processors”) to host, secure, and operate the platform. We review each Sub-processor before granting access to Customer Data and require contractual commitments to confidentiality, security, and processing limitations consistent with our Data Processing Addendum. We aim to keep the list short and only add Sub-processors when there is a clear product or operational need.
For each Sub-processor we list the legal entity, what we use it for, the regions in which Customer Data may be processed, and the categories of data shared. Where a Sub-processor processes Personal Data subject to the GDPR or UK GDPR outside an adequate jurisdiction, we rely on the European Standard Contractual Clauses or the UK International Data Transfer Addendum.
Core infrastructure
| Sub-processor | Purpose | Location | Data processed |
|---|---|---|---|
| Vercel, Inc. | Application hosting, edge runtime, and CDN | United States, EU | All Customer Data in transit; cached static assets |
| Supabase, Inc. | Primary database, authentication, and object storage | United States | Customer accounts, Customer Data, application data |
| Cloudflare, Inc. | DNS, network security, and DDoS protection | United States, EU (edge nodes globally) | Network metadata; no Customer Data is stored |
Data and analytics
| Sub-processor | Purpose | Location | Data processed |
|---|---|---|---|
| PostHog Inc. | Product analytics, session metrics, and feature flags | United States | Pseudonymous usage events; no Customer-uploaded contact data |
| Sentry (Functional Software, Inc.) | Error tracking and performance monitoring | United States | Error stack traces and request metadata; PII scrubbed before send |
AI and language models
We use language models to generate the briefs and grounded answers our customers see. We send only the minimum context required to perform the task, and we contract with these vendors under terms that prohibit them from training their models on our prompts or outputs.
| Sub-processor | Purpose | Location | Data processed |
|---|---|---|---|
| Anthropic, PBC | Claude API for grounded research and brief generation | United States | Public school information and customer prompts; processed under Anthropic's zero-retention API terms (no model training) |
| OpenAI, L.L.C. | Backup language model for enrichment and summarization | United States | Public school information and customer prompts; processed under OpenAI's enterprise zero-retention terms |
Communications
| Sub-processor | Purpose | Location | Data processed |
|---|---|---|---|
| Resend (Drift Software, Inc.) | Transactional email delivery (sign-in, account, support) | United States | Email address, name, and message content |
Billing
| Sub-processor | Purpose | Location | Data processed |
|---|---|---|---|
| Stripe, Inc. | Payment processing, invoicing, and tax | United States | Billing contact details, address, payment-method metadata. Full card numbers are stored only by Stripe. |
Updates and notifications
We will give existing customers at least 30 days' notice before adding a new Sub-processor that processes Customer Personal Data, by updating this page and, on request, by email. To receive email notifications when this list changes, write to hello@schoolintel.co with the subject “Subscribe to sub-processor updates.”
Customers who object to a new Sub-processor on reasonable data-protection grounds within the notice period and who cannot reach a resolution with us may terminate the affected portion of the Services and receive a pro-rated refund of any prepaid fees, as set out in the DPA.