the short version
The table below is every third party that touches personal data on our behalf, what it is for, what it sees, and where it runs. It is short on purpose.
If you are an institution on the data processing agreement, you get thirty days’ notice before anything is added to it or swapped out.
a summary, not the agreement — the clauses below are what binds
We keep this list current. Institutional customers subscribing to the DPA receive 30 days’ notice of any addition or replacement.
| Provider | Purpose | Data | Region |
|---|---|---|---|
| Vercel Inc. | Application hosting, edge network, deployment automation | Request logs (redacted); no persistent user data | US primary, global edge |
| Supabase Inc. | Authentication, Postgres database, file storage | All application data at rest | US primary; Canada-East region available on request for institutional customers |
| Anthropic PBC | AI model inference (Claude Sonnet + Haiku) | Prompt content (problem, student attempt, class context). Zero-retention API terms — not used for training. | US |
| Stripe Inc. | Payment processing, subscription management, invoicing | Billing email, payment method (never stored on Brainback), invoice metadata | US primary, Ireland (EU customers) |
| Resend Inc. | Transactional email delivery | Recipient email + subject + body | US |
| Upstash Inc. | Rate-limit backend (Redis) | User/IP identifiers as rate-limit keys; no content | US (Global multi-region) |
| PostHog Inc. | Product analytics, session replay (input-masked) | Event names, numeric properties, page URLs, masked replay. Student content excluded. | US |
Not sub-processors
- No advertising networks.
- No data brokers.
- No cross-site tracking pixels.
Objections
Institutional customers may object to a sub-processor addition in writing to brainback@stratosync.solutions within 30 days of notice.