Current providers
| Provider | Role | Data processed | Region | Status |
|---|---|---|---|---|
| Neon | Managed PostgreSQL database | All application data, including health data and consent records | Confirmed per school; pinned to the EU for EU schools | In use |
| Vercel | Application hosting, private file storage (Blob) and cookieless aggregate analytics | Application content in transit, payment receipts, profile pictures, scanned consent forms | Global network; functions and storage in the configured region | In use |
| MercadoPago | Billing the school's subscription | The school's billing details. Receives no student data | Argentina and LATAM | Integration in progress |
"Integration in progress" means the provider is planned and contracted but is not yet receiving personal data from the system. When it starts to, we change the status and publish a new version of this page.
How we announce a change
Before adding a new subprocessor, or changing the role of an existing one, we publish the change here and notify each school at least 30 days in advance.
During that period the school may object in writing, with reasons. If we cannot find a reasonable alternative, it may cancel the service without penalty and export its data.
An urgent replacement caused by a serious provider failure may happen before the notice period ends; in that case we notify immediately and explain why.
Contractual instruments
We have each provider's data processing agreement in place, with standard contractual clauses where there is an international transfer. Schools can ask us for copies of the publicly available ones and for the effective hosting region.