Currently in use
These are the companies that process data on our behalf to run the platform. Providers are notified before we add one.
| Company | What they do | What they see | Where |
|---|---|---|---|
| Supabase | Database, authentication and file storage — the primary system of record | All platform data: accounts, learning records, evidence files, messages, safeguarding records | EU (Ireland) |
| Vercel | Application hosting and content delivery | Request metadata and IP addresses in transit; no application data stored at rest | EU region, global edge network |
| Anthropic | AI helper, KSB tag suggestions, grading feedback, welfare scanning, outreach drafting | Lesson content, learner questions, reflections and the text being assessed. Contracted not to train on it; zero data retention where configured. | USA |
| Voyage AI | Text embeddings for lesson-content retrieval | Lesson content only. No learner-written text is embedded. | USA |
| Mux | Video hosting and playback for lesson content | Lesson video files. Mux Data playback analytics (device, approximate location from IP, viewing time); no account identifier is sent. | USA / EU |
| Resend | Transactional email — invitations, notifications, digests | Recipient name, email address, and the email body | USA / EU |
| Upstash | Distributed rate limiting | A hashed account identifier and request timestamps. No content. | EU (configurable) |
| Sentry | Error monitoring | Stack traces and error messages. Configured to strip request bodies, cookies and authorisation headers, and not to send personally identifying data. | EU (Frankfurt) |
| PostHog | Product analytics — only with cookie consent | Page paths and a small set of product milestones, keyed to an account identifier. Never reflections, messages or AI conversations. | EU (Frankfurt) |
Only when a learner connects an account
Business-growth tracking is opt-in. Nothing below is contacted unless a learner authorises it, and the connection can be revoked at any time from their dashboard.
| Company | What they do | What they see | Where |
|---|---|---|---|
| Meta (Instagram, Facebook), TikTok, LinkedIn, YouTube/Google, X | Reading a learner’s own creator analytics, only after they explicitly connect the account | Data flows inward — we read follower and engagement metrics. We do not send learner records to these platforms. | USA |
What is not on this list
We do not use advertising networks, data brokers, or session-recording tools. No sub-processor is permitted to use platform data to train a model.