You’re here
Impact Suite engages a limited set of subprocessors to deliver our services. Every subprocessor that processes educational-agency data is United States–based, and we provide 30 days’ advance notice of new or changed subprocessors, as set out in our Data Processing Agreement.
Where our agreements stand. Signed Data Processing or Business Associate Agreements are in place with Amazon Web Services (covering every AWS service listed below, which all run inside our own AWS account), Ednition (RosterStream) and PostHog. Agreements with Twilio, Mailgun, SendGrid, Mapbox, Flatfile, Ragie and Google are in progress and not yet signed. We would rather tell you that than describe the set as complete.
Subprocessors that process educational-agency data
| Subprocessor | Purpose | Data categories | Location | Agreement |
|---|---|---|---|---|
| Amazon Web Services (AWS) | Cloud hosting, database, file storage, encryption | All student/staff/guardian data & files | U.S. (us-west-2) | Signed |
| AWS Bedrock (Anthropic Claude) | AI assistant (AskImpact), drafting, insights | Minimum-necessary data in prompts | U.S., within AWS | Signed (AWS) |
| AWS Bedrock Knowledge Bases | Document retrieval for AskImpact | District documents and help content | U.S., within AWS | Signed (AWS) |
| AWS Transcribe | Speech-to-text (dictation) | Transient dictation audio | U.S., within AWS | Signed (AWS) |
| AWS Polly | Text-to-speech (read-aloud) | Text to be voiced | U.S., within AWS | Signed (AWS) |
| AWS Textract | Document OCR | Uploaded document images | U.S., within AWS | Signed (AWS) |
| AWS SNS | Backup text-message delivery | Phone numbers, message content | U.S., within AWS | Signed (AWS) |
| Ednition (RosterStream) | SIS / rostering sync & SSO | Roster, enrollment, guardian contacts | U.S. | Signed |
| PostHog | Product analytics & feature flags | Usage/telemetry events | U.S. | Signed |
| Twilio | SMS (broadcasts, SafeTip, attendance) | Guardian/staff phone, message content | U.S. | In progress |
| Mailgun | Outbound transactional email | Email addresses, message content | U.S. | In progress |
| SendGrid | Inbound email parsing | Parent reply content | U.S. | In progress |
| Mapbox | Address geocoding & maps | Student home address (geocoding) | U.S. | In progress |
| Flatfile | Spreadsheet and roster import | Roster and student data during an import | U.S. | In progress |
| Ragie | Alternate document retrieval, only where configured | District documents | U.S. | In progress |
| Google (Classroom API) | Classroom connector, only when a district turns it on | Class rosters, coursework, enrollment | U.S. | In progress |
How we manage subprocessors
- Vetting — security and compliance review before engagement (certifications, encryption, incident response, data handling).
- Contracts — Data Processing Agreements (using the 1EdTech DPSA framework) or Business Associate Agreements, with flow-down data-protection terms. The table above shows which are signed today.
- Monitoring — ongoing review of subprocessor compliance and certifications.
- AI providers — all AI processing is performed by AWS services within our AWS environment; see AI data handling. Ragie is an alternate document-retrieval provider, used only where it is configured.
A current subprocessor list is always available here and upon request.
