Trust: Sub-processors
Sub-processors
The companies that process personal data on our behalf, what each receives, and where.
- Last updated
- 2026-09-25
- Questions
- [email protected]
Each provider gets only what it needs to do its job. None of them may use the data for their own purposes. Institutions with a data protection agreement are told before we add a provider that handles student data. See also the security overview and the privacy policy.
| Provider | What for | Data it receives | Location |
|---|---|---|---|
| Amazon Web Services | Application hosting, database, file storage and backups | All account, course and classroom data | United States (us-west-1, N. California) |
| Cloudflare | HTTPS, content delivery, bot and attack protection | Web traffic in transit, IP addresses | Global edge network |
| Authorize.net | Card payments | Card details (entered in their hosted form, never on our servers), billing name and address | United States |
| Mailgun | Sign-in codes, receipts and other email | Name, email address, message content | United States |
| Anthropic | AI tutor and support chat | The question asked, the textbook passage it concerns, a summary of reading progress. Not used to train models. | United States |
| Voyage AI | Book search and tutor retrieval | Textbook passages and search queries | United States |
| Sentry | Error monitoring | Technical error reports, which can include an account identifier | United States |
| Slack | Internal staff alerts (form submissions, unanswered support questions) | Form contents, support-chat questions | United States |
| Site analytics and ad measurement, only after a visitor accepts the analytics banner | Pages visited, device and browser details | United States | |
| FedEx | Shipping rates and address checks for printed books | Delivery address | United States |
| AccuTrack | Printed book fulfillment | Name, delivery address, email, order contents | United States |