Subprocessors.

Last updated: October 2026

The Student Blueprint engages a limited number of third-party service providers ("subprocessors") to operate the platform. We have a written data protection agreement with each subprocessor that restricts their use of data to the purposes described below, requires confidentiality, and obligates them to maintain reasonable security practices.

We notify customers under active Data Privacy Agreements of material subprocessor changes prior to onboarding, in accordance with Student Data Privacy Consortium National Data Privacy Agreement (SDPC NDPA) requirements.

Current subprocessors.

Supabase(privacy policy, opens in a new tab)
Purpose
Primary database, authentication, object storage
Data processed
All application data including student assessments and account records
Location
United States
Vercel(privacy policy, opens in a new tab)
Purpose
Application hosting, CDN, edge functions
Data processed
Request metadata, IP addresses, application traffic
Location
United States (global edge)
Anthropic (Claude)(privacy policy, opens in a new tab)
Purpose
AI-generated assessment analysis (fallback model)
Data processed
Assessment data submitted by the student during analysis; not used to train Anthropic models per Anthropic's commercial terms. PII redaction available per tenant policy.
Location
United States
Google Gemini API(privacy policy, opens in a new tab)
Purpose
AI-generated assessment analysis (primary model)
Data processed
Assessment data submitted by the student during analysis. PII redaction available per tenant policy. Planned migration to Vertex AI for stronger no-training guarantees.
Location
United States
Stripe(privacy policy, opens in a new tab)
Purpose
Payment processing
Data processed
Billing name, billing address, payment card details. Card numbers and CVV never touch our servers (PCI DSS Level 1).
Location
United States
Resend(privacy policy, opens in a new tab)
Purpose
Transactional email delivery (assessment results, OTP codes, parent notifications)
Data processed
Recipient email address, email content, delivery metadata
Location
United States
Upstash Redis(privacy policy, opens in a new tab)
Purpose
API rate limiting and queue (QStash)
Data processed
IP addresses, request counters, job metadata. No assessment data.
Location
United States

AI model use of student data.

Student assessment data sent to Anthropic and Google for AI analysis is not used to train their underlying models, per the commercial API terms of each provider. District tenants may additionally enable per-tenant settings to (a) disable AI processing entirely, or (b) require PII redaction before any data leaves The Student Blueprint infrastructure.

Data residency.

All primary data storage is located in the United States. Edge caching and CDN delivery may transit Vercel's global edge network for static assets only; authenticated application data is served from U.S. regions.

Notification of changes.

Customers under a Data Privacy Agreement receive advance notice of any new subprocessor. To subscribe to subprocessor change notifications, contact privacy@thestudentblueprint.com.