Sub-processors list

Vercel Inc., USA

Hosting of the application, edge network and CDN, serverless compute, the web application firewall, the durable workflows that dispatch transactional e-mail, and the AI Gateway that routes requests to the language model.

All application data in transit, request and function logs, visitors' IP addresses, and the redacted prompts passed on to the language model.

Global edge network; compute and logs in the deployment's configured region

PlanetScale, Inc., USA

Managed PostgreSQL — the single database the whole application runs on.

All application data at rest: staff accounts (name, e-mail, password hash), sign-ins (IP address, browser), pupils (name, date of birth, notes), class rosters, teachers' observations, reflections, and the audit log.

EU

Google Cloud EMEA Limited, Ireland

Language-model inference for AI-drafted pupil reflections, run on Vertex AI in the EU and reached through the Vercel AI Gateway. The model is Anthropic's Claude, hosted by Google, so the data goes to Google and not to Anthropic. A draft is only ever a suggestion. A teacher reads, edits and approves it before it becomes a record. Every request is pinned to Vertex AI in the EU, and one that cannot be served there fails instead of going to another provider.

The reflection prompt: the school's prompt text, teachers' observations, lesson progress, the current reflection and, when a teacher asks for a rewrite, the draft on screen together with their instruction. The pupil's name and its variants are struck out of every free text before it leaves the application, and no account identifiers are sent.

EU

Soniox Inc., USA

Speech-to-text for dictating an observation note. The teacher speaks into the microphone and Soniox's model turns the words into text. The transcript is only input to the text box: the teacher sees it and can edit it before saving. The model reads nothing from the voice but its words. It does not identify the speaker, infer emotions or assess anything. Dictation is optional, and no audio is sent unless the teacher clicks the microphone.

The microphone audio while a dictation runs (one minute at most per session) and its transcript. That is the teacher's voice and what they say, which may include pupils' names and remarks about them, and any voices nearby. The audio goes from the browser straight to Soniox, which sees the device's IP address. No account or school identifiers are sent with it. Amosia stores neither the audio nor the transcript. Soniox stores neither for real-time transcription and does not use them to train models.

EU

Plus Five Five, Inc. (Resend), USA

Transactional e-mail — the password-reset and welcome messages sent to staff. Amosia sends no marketing e-mail.

The recipient's e-mail address and name, the school's name, and the message body including its single-use link.

USA

Functional Software, Inc. (Sentry), USA

Error monitoring, performance tracing and sampled session replay of the staff interface, plus the in-app feedback form, so that faults are found and can be reported.

Error events and stack traces, browser and device metadata, and sampled recordings of staff sessions. Automatic reporting carries no user identity, no AI inputs or outputs, no request bodies and no IP-bearing headers, cookies or query parameters. The in-app feedback form is the exception: it sends what the member writes, their e-mail address (prefilled from their account, editable and removable before sending) and a recording of the session.

EU

Google Ireland Limited, Ireland

The optional “Sign in with Google” button for staff accounts. Only staff who choose that button reach Google; signing in with e-mail and password does not. For the Google account itself, Google acts as an independent controller rather than as our sub-processor.

Google account identifier, e-mail address and display name, exchanged at sign-in.

EU and USA