This is the current list of third parties that process information on our behalf. Where a detail has not yet been independently verified we show ‘Verification required’ rather than a guess.
| Provider | Purpose | Data | Storage region | Processing region | Retention | Training use | Verified |
|---|---|---|---|---|---|---|---|
| OpenAI | AI writing feedback, curriculum analysis, revision analysis, handwriting transcription and text-to-speech | Student writing (identifiers redacted before sending), year-level curriculum documents | Verification required | United States / overseas | Response objects sent with store=false (not retained). Curriculum reference documents are stored in an OpenAI vector store to support file search. | Not used for model training under OpenAI's API data policy (verification of contractual ZDR pending) | 2026-06-01 |
| Emergent (application platform) | Application hosting (frontend + backend) and object storage for uploaded images and generated reports | All application data in transit; handwriting images and generated report files at rest in object storage | Verification required | Verification required | For the life of the account unless deleted; see Retention and Deletion | Not used for model training | 2026-06-01 |
| MongoDB (application database) | Primary database for accounts, classes, writing, assessments, audit records | All structured application data | Verification required | Verification required | For the life of the account unless deleted; encrypted backups up to a further 90 days | Not used for model training | 2026-06-01 |
| Resend | Transactional email (invitations, password resets) | Recipient email address and message content (no student writing) | Verification required | United States / overseas | As per Resend's retention policy | Not used for model training | 2026-06-01 |