Legal
Subprocessors
Last updated:
Classentra Technologies Inc. uses the third-party subprocessors below to provide the Classentra service. Each processor's Data Processing Addendum is incorporated by reference via that processor's paid-plan Terms of Service. Standard Contractual Clauses (or the UK Addendum / IDTA / Swiss FDPIC variant where applicable) are included in those DPAs.
This list is maintained as the single source of truth for who processes personal information on Classentra's behalf. Internal copies of each processor's DPA, SOC 2 report (where available), and subprocessor list are kept under docs/legal/contracts/ in the Classentra source repository and are available to enterprise customers under NDA.
We notify enterprise customers of new or replaced subprocessors at least 30 days in advance by updating this page and by emailing the privacy contact on file. Customers may object in writing within that window; we will work in good faith to provide an alternative or terminate the affected service with a prorated refund.
Active subprocessors
| Subprocessor | Purpose | Location of processing | Data categories | DPF certified |
|---|---|---|---|---|
| Neon, Inc. | Managed PostgreSQL database | United States (aws-us-east-1, Virginia) | All operational personal data: identity, authentication, course content, educational records, billing tokens, messages, AI prompts, telemetry | Verify |
| Vercel, Inc. | Application hosting + edge network | United States (iad1 primary; CDN global) | Personal data in transit; ephemeral runtime processing; build logs | Likely |
| Stripe, Inc. | Payment processing + Stripe Connect teacher payouts | United States (multi-region; India for INR) | Cardholder data, billing address, payout details | Yes |
| Resend, Inc. | Transactional + marketing email delivery | United States | Email address, name, message content | Verify |
| OpenAI, LLC | AI-assisted teaching features | United States (API tier; Zero Data Retention where applicable) | User prompts and AI-generated outputs | Yes |
| Daily.co | Live video infrastructure for native classes | United States (multi-region edge) | Media streams in transit; session metadata | Verify |
| LiveKit Inc. | Alternative live video provider | United States (us-east) | Media streams in transit; session metadata | Verify |
| Cloudflare, Inc. (R2) | Object storage for recordings, materials, exports, certificates | United States bucket; EU bucket added at T2 trigger | User-uploaded files and AI-generated artifacts | Yes |
| Upstash, Inc. | Managed Redis for caching and rate-limit counters (planned) | United States (global edge) | Short-TTL cache entries; rate-limit counters; hot-key snapshots | Verify |
| Inngest, Inc. | Background job queue and retries (planned) | United States | Job payloads (user IDs, references) | Verify |
| Functional Software, Inc. (Sentry) | Error tracking and performance monitoring | United States | Error stack traces; scrubbed browser context (no PII) | Yes |
| Vercel Analytics | Cookie-less page analytics | United States | Aggregated page-view counts; country-level geo derived from IP. No personal identifiers. | Likely |
| Namecheap Private Email | Inbound and outbound mail for support@, privacy@, billing@, and other aliases | United States | Email content and headers | Verify |
Subprocessor changes
- — Initial publication.
Customer rights
- Object: enterprise customers may object to a new subprocessor in writing within 30 days of notice.
- Audit: customers may request annual subprocessor audit reports (SOC 2 / ISO 27001) under NDA.
- Withdraw: termination rights described in the applicable Data Processing Addendum apply.
Contact
For questions about this list, write to privacy@classentra.com. We aim to respond within 30 days.