Sub-processors

Our sub-processors

Ed.ai engages a short, audited list of service providers to deliver the product. Each one is bound by a data processing agreement, handles only the data strictly necessary for its role, and is reviewed annually.

Last updated: June 8, 2026

How we keep this list current

• We publish the current sub-processor list on this page and keep it up to date.

• Each sub-processor handling personal data is bound by a data processing agreement and reviewed annually.

• Schools and districts under an NDPA retain the rights granted by their agreement (see the DPA page).

Sub-processor list

Legend:

• Location = the region where data is processed / stored, not the vendor's HQ.

• Safeguards = signed DPA (✓), SOC 2 / ISO 27001 attestation where applicable.

Infrastructure

• Microsoft Azure (hosting) — Primary cloud infrastructure — compute, storage, networking, identity · All customer content (student work, grades, analytics, account metadata) · US Central · DPA ✓ · SOC 2 Type II · ISO 27001 · ISO 27018 · FedRAMP High (for relevant services)

• Microsoft Azure (storage & backups) — Blob storage, encrypted backups · Student work images, PDFs, derived data · US Central · DPA ✓ · encryption with separate keys

AI processing

• Azure OpenAI Service — Language model inference (GPT family) · De-identified transcriptions of student work; teacher queries · Microsoft Azure US Central · No-retention, no-training terms · DPA ✓

• Azure AI — Mistral — Language model inference (Mistral family) · De-identified transcriptions; teacher queries · Microsoft Azure US Central · No-retention, no-training terms · DPA ✓

• Google Cloud — Gemini — Language model inference (Gemini family) · De-identified transcriptions; teacher queries · Google Cloud, US · No-retention, no-training terms · DPA ✓

Product operations

• Sentry — Application error tracking · Error logs, stack traces (no student content; PII scrubbing enabled) · US · DPA ✓ · SOC 2 Type II

• Pylon — Customer support platform for teacher/admin tickets · Support conversations, teacher/admin email, account metadata · US · DPA ✓ · SOC 2

• Google Analytics — Website analytics (restricted configuration: IP anonymization, no Google Signals / advertising features, consent-based) · Page-view data for the public website; no student data · US / Google global · No personal student data · DPA ✓

Communication & CRM

• Mandrill (Mailchimp Transactional) — Transactional email (account, password reset, system notifications) · Teacher/admin email, name, account events · US · DPA ✓ · SOC 2

• Mailchimp — Marketing email campaigns (teachers/admins — no student data) · Teacher/admin email, name, marketing engagement · US · DPA ✓ · SOC 2

• HubSpot — Marketing CRM (teacher prospects, district contacts — no student data) · Contact info for teachers/admins, marketing engagement · US · DPA ✓ · SOC 2

Roster & integration providers

• Edlink — Unified roster + class data integration (Clever, ClassLink, Google Workspace for Education, Canvas, Schoology, etc.) · Class rosters, SSO attributes, student/teacher identifiers · US · DPA ✓ · SDPC signatory — participates in state DPA frameworks

Clever, ClassLink, Canvas, and Google Workspace for Education appear on this list when a school provisions Ed.ai through Edlink — Edlink is the abstraction layer. If a school connects directly to one of these providers outside of Edlink, that provider becomes an additional sub-processor for that school.

Where student data is processed

All student data — scanned work, transcriptions, grades, analytics, roster identifiers — is processed and stored in the United States. See the Security page for details.

Website analytics (Google Analytics) and marketing tools process only non-student data (public website visitors, teacher/admin contacts) and may use the vendor's global infrastructure. No student work crosses US borders.

Changes to this list

How we communicate changes:

1. The updated list is published on this page.

2. The change log (below) is updated with the date and rationale.

Contractual rights: Schools and districts under an NDPA (with General Offer or a direct signature) retain the rights granted by their agreement regarding sub-processors, including any right to object. If we cannot find an alternative that meets the district's requirements, the district may terminate the contract without penalty.

Change log

• June 8, 2026 — Initial US list published. Migration to US-dedicated stack on launch of Ed AI Technologies, Inc.

Contact

Questions about a sub-processor, or a request for a copy of a sub-processor DPA (under NDA): privacy@ed.ai.