Subprocessors

Impact Suite engages a limited set of subprocessors to deliver our services. All subprocessors that process educational-agency data are United States–based and operate under a Data Processing Agreement or Business Associate Agreement. We provide 30 days’ advance notice of new or changed subprocessors, as set out in our Data Processing Agreement.

Subprocessors that process educational-agency data

Subprocessor	Purpose	Data categories	Location
Amazon Web Services (AWS)	Cloud hosting, database, file storage, encryption	All student/staff/guardian data & files	U.S. (us-west-2)
AWS Bedrock (Anthropic Claude)	AI assistant (AskImpact), drafting, insights	Minimum-necessary data in prompts	U.S., within AWS
AWS Transcribe	Speech-to-text (dictation)	Transient dictation audio	U.S., within AWS
AWS Polly	Text-to-speech (read-aloud)	Text to be voiced	U.S., within AWS
AWS Textract	Document OCR	Uploaded document images	U.S., within AWS
Ednition (RosterStream)	SIS / rostering sync & SSO	Roster, enrollment, guardian contacts	U.S.
Twilio	SMS (broadcasts, SafeTip, attendance)	Guardian/staff phone, message content	U.S.
Mailgun	Outbound transactional email	Email addresses, message content	U.S.
SendGrid	Inbound email parsing	Parent reply content	U.S.
Mapbox	Address geocoding & maps	Student home address (geocoding)	U.S.
Flatfile	CSV / roster import	Imported roster data	U.S.
PostHog	Product analytics & feature flags	Usage/telemetry events	U.S.

How we manage subprocessors

• Vetting — security and compliance review before engagement (certifications, encryption, incident response, data handling).
• Contracts — Data Processing Agreements (using the 1EdTech DPSA framework) or Business Associate Agreements, with flow-down data-protection terms.
• Monitoring — ongoing review of subprocessor compliance and certifications.
• AI providers — all AI processing is performed by AWS services within our AWS environment; see AI data handling.

A current subprocessor list is always available here and upon request.