Sub-processors

Third-party processors engaged to process personal data on our behalf

As a data processor, Education Companion engages the following sub-processors to help deliver our services. Each sub-processor processes personal data only as necessary to perform their specific function, in accordance with our Data Processing Agreement and applicable data protection laws including UK GDPR.

We maintain appropriate contractual arrangements with each sub-processor to ensure they provide adequate safeguards for personal data. For transfers outside the UK and European Economic Area, we rely on Standard Contractual Clauses (SCCs) or adequacy decisions where applicable.

Last updated: January 26th, 2026

Browserbase

Description of processing: Headless browser automation used to retrieve publicly available school policy documents for compliance reference. No personal information is obtained using Browserbase.

Processing location: USA

Clerk

Description of processing: Provides authentication, session management, and organisation membership management for Education Companion users.

Processing location: United States (US)

Website GDPR DPA

Cloudflare

Description of processing: Serverless processing used for public document handling only, including PDF file processing.

Processing location: EU / UK / USA

Google APIs

Description of processing: Used to export aggregate platform statistics and anonymised operational data to internal reporting tools. No individual personal data is transferred.

Processing location: USA

HubSpot

Description of processing: CRM and marketing platform used to manage school and trust contact information, support communications, and send transactional emails on behalf of Education Companion.

Processing location: EU

Neon

Description of processing: Hosts the primary application database containing organisation, user, and case data required to deliver the service.

Processing location: United Kingdom (UK)

Website DPA

Novu

Description of processing: Manages notification workflows and delivery (e.g., in-app/email notifications) for users and organisations.

Processing location: European Union (EU)

Website DPA

OpenAI

Description of processing: Processes user-provided prompts, case content, and policy documents to provide AI-generated drafts and suggestions.

Processing location: United States (US)

Website DPA Enterprise Privacy

PostHog

Description of processing: Used to understand product usage patterns and improve the platform.

Processing location: EU

Resend

Description of processing: Sends transactional emails and processes inbound emails to Education Companion inboxes, including message content and attachments.

Processing location: European Union (EU) - Provider DPA indicates transfers to the United States may occur.

GDPR DPA Website

Sentry

Description of processing: Collects diagnostics for application stability and performance, such as error traces and request metadata.

Processing location: United States (US)

Website DPA

Slack

Description of processing: Internal communication platform. Receives automated webhook notifications including login events and user feedback for operational monitoring.

Processing location: USA

Trigger.dev

Description of processing: Runs background tasks (e.g., workflows) using payloads that reference case and organisation records.

Processing location: European Union (EU)

Website DPA

UploadThing

Description of processing: Stores and serves uploaded files such as case attachments, policy documents, and inbound email attachments.

Processing location: European Union (EU)

Vercel

Description of processing: Hosts the Education Companion application and related platform services, including logs and operational metadata.

Processing location: United Kingdom (UK)

Website DPA

Wonde

Description of processing: Integrates with school MIS systems to read core identity and relationship data used to match complaints/cases to people and groups.

Processing location: United Kingdom (UK)

Website DPA

Changes to Sub-processors

We may update this list from time to time as we engage new sub-processors or change existing arrangements. Material changes to our sub-processor list will be communicated to customers in accordance with our Data Processing Agreement.

If you have questions about our sub-processors or data processing practices, please contact us at support@educationcompanion.com