Public · Last updated September 4, 2026
Subprocessor List
Every vendor that touches service data, what it does, where it runs, and the agreement that binds it. Referenced from our Privacy Policy and NDPA exhibits.
| Subprocessor | Service | Purpose | Data categories | Location | Flow-down agreement |
|---|---|---|---|---|---|
| Microsoft Corporation | Azure App Service, Azure Database for PostgreSQL, Azure Blob Storage, Azure Communication Services | Hosting, database, file storage, transactional email delivery | All service data (encrypted in transit + at rest) | United States (Central US region) | Microsoft Products and Services DPA |
| Google LLC | Vertex AI (Gemini) | Teacher-invoked AI drafting and extraction | Content of the specific request (minimized where feasible); no training on customer data | United States (us-central1, Iowa — pinned in configuration) | Google Cloud Data Processing Addendum |
| Google LLC | Classroom API, Gmail/Workspace APIs | Roster/coursework sync; sending teacher-approved emails via teacher's account | Data covered by the teacher's OAuth grant (read-only Classroom scopes) | Google Workspace (LEA's own tenant) | Operates under the LEA's Google Workspace for Education agreement + teacher OAuth consent |
| Ednition, Inc. | RosterStream (Core Rostering, SSO Connect, LMS Link) | District-authorized roster, enrollment, and single sign-on integration with the district's SIS/LMS (PowerSchool, Infinite Campus, Skyward and other OneRoster systems, Clever, ClassLink, Ed-Fi; Canvas/Schoology via LTI 1.3 where the district enables it) | Roster and directory data only: student/staff names, school emails, external IDs, grade level, school, course and section enrollments; guardian contact fields only where the district's SIS shares them. Never teacher notes, evidence, communications, or AI content. | United States (Amazon Web Services US regions; tenancy pinned to the US) | Ednition Terms of Service and Privacy Statement (processing only as instructed, no AI training, confidentiality, deletion within 60 days of termination); Ednition Data Processing Addendum + Security Addendum in procurement; SOC 2 Type 2 attested, ISO/IEC 27001:2022 certified, annual penetration testing — trust.ednition.com |
Notes
- No analytics, advertising, error-tracking, or session-replay vendors are used anywhere in the product (verified in code audit, July 2026).
- Ednition, Inc. was added on September 4, 2026 under the change process below as our district-integration partner. Ednition processes roster and directory data only, under Agenteach's direction, and operates under its standard terms while its Data Processing Addendum and Security Addendum are procured; a full description of the partnership, the data boundary, Ednition's assurance reports, and the framework mapping is in Privacy Policy §7.
- Change process: LEAs under agreement receive advance notice of any subprocessor addition or change; new subprocessors are bound to equivalent privacy, security, deletion, and breach-response terms before receiving any data.