Subprocessor Registry
Live registry page: /legal/subprocessors
Last reviewed: August 24, 2026
Change notice: Material additions or replacements will be posted here; Institutions under a DPA will also receive notice per that agreement (target: at least 14 days before use for new subprocessors processing education records, except emergency security substitutions).
Infrastructure
| Subprocessor | Role | Location | Data involved |
|---|---|---|---|
| DigitalOcean, LLC | Application hosting (droplets), managed PostgreSQL, object/network services as used | USA | Application data, education records, backups |
| Cloudflare, Inc. | DNS, CDN/proxy, WAF, DDoS, bot management | Global edge; origin USA | IP addresses, request metadata, TLS; may see request URLs/headers |
Hosting assurance (DigitalOcean)
Coursekit and Studian run on DigitalOcean (application droplets and managed PostgreSQL in the United States). DigitalOcean maintains SOC 2 Type II and SOC 3 Type II attestations for its infrastructure. Those reports cover DigitalOcean's controls — physical facilities, hypervisor, and managed platform — not Coursekit or Studian as products. We are not ourselves SOC 2 attested; that work is on our roadmap.
Current DigitalOcean reports are kept on file under NDA and can be shared with institutions under NDA on request. We do not publish DigitalOcean's SOC 2 report on this site.
Communications
| Subprocessor | Role | Location | Data involved |
|---|---|---|---|
| Microsoft Corporation (Microsoft Graph / Microsoft 365) | Transactional email (invitations, password reset, product notices) | USA (tenant-dependent) | Email addresses, message content of notices |
AI / LLM (feature-dependent; Institution-configurable)
Default and optional model providers may receive prompts and context when AI features are used:
| Subprocessor | Role | Notes |
|---|---|---|
| OpenAI, L.L.C. | LLM API | Primary/default for many features; execute API DPA / ZDR where eligible |
| Anthropic PBC | LLM API | Optional per Institution configuration |
| Google LLC (Gemini API) | LLM API | Optional |
| Mistral AI | LLM API | Optional |
| DeepSeek | LLM API | Optional |
| Groq, Inc. | LLM inference API | Optional |
| xAI | LLM API | Optional |
| Tavily | Web research / retrieval tool (if enabled) | Optional tool calls may send query text |
Institutions should treat enabled AI providers as subprocessors for student prompts and related context.
Company
The AI Systems Architect LLC personnel with role-based access may process data to operate and support the Services under confidentiality and access-control policies.
How to inquire
[email protected] — request the current signed provider DPAs / DPA packet for procurement, including DigitalOcean’s SOC 2 Type II report under NDA.