Subprocessor List
Last updated: October 22, 2026 · Replaces the list of July 13, 2026
This page lists every outside company that handles data for Co-Teacher, what each one does, whether it touches student data, where it processes, and how long it keeps anything. It is the list the School Data Privacy Agreement refers to in Schedule 3, so a change here is a change to the agreement: we email every signed school at least 30 days before adding or replacing a vendor that will process student data, and a school may object.
How to read this list
“Stored” means the vendor holds the data for as long as a school’s account is active, and deletes it on our schedule (within 30 days of a deletion request, with backups purged within 30 days after that). “Processing only” means the vendor handles the data to return a result and stores nothing afterward. No vendor on this page may use student data for its own purposes, and none may use it to train an artificial intelligence model. All AI model calls run through one gateway, Vercel AI Gateway, with zero data retention enabled for our account. The model providers below are the ones it may route to, and it does not route to a provider that has not agreed to zero-retention terms with Vercel.
Vendors that handle student data
| Vendor | What it does for Co-Teacher | Student data | Location | Retention and training |
|---|---|---|---|---|
| Supabase | Database, sign-in and file storage for the application | Stored | United States | Kept while the school’s data is active; deleted on our schedule. No training. |
| Amazon Web Services | Cloud infrastructure, storage and server logs | Stored | United States | Same. Server logs carry no student names and expire after 30 days. |
| Vercel | Hosts the application and runs the AI Gateway that routes each model call | Processing only | United States | Zero data retention is turned on for our account: the gateway stores no inputs or outputs, and routes only to the AI providers below, each of which has agreed to zero-retention terms. |
| Google (Gemini models), through Vercel AI Gateway | Reads and analyzes student work | Processing only | United States | Zero data retention; no training. |
| OpenAI, through Vercel AI Gateway | Re-runs scans, provides backup analysis when the primary model returns nothing, and runs our own accuracy checks | Processing only | United States | Zero data retention; no training. |
| Anthropic (Claude models), through Vercel AI Gateway | Generates teacher materials: lessons, worksheets, small-group plans | Processing only; includes student names and responses | United States | Zero data retention; no training. |
| Amazon Bedrock, through Vercel AI Gateway | Serves the same models as the providers above when a primary provider is unavailable | Processing only; the same data the model it serves would receive | United States | Zero data retention; no training. |
| Google Vertex AI, through Vercel AI Gateway | Serves the same models as the providers above when a primary provider is unavailable | Processing only; the same data the model it serves would receive | United States | Zero data retention; no training. |
| TypeSafe AI, through Vercel AI Gateway | Matches a name read from student work to the teacher’s class list. Receives name text only, never student work | Processing only; names | United States | Zero data retention; no training. |
| Google Cloud Translation | Translates family-facing materials into the languages a teacher chooses | Processing only | United States | Text is held in memory only while it is translated, under our own Google Cloud account; not stored; not used for training. |
| Resend | Sends our emails, and receives work a teacher sends in by email | Stored briefly (emailed scans only) | United States | Inbound messages are deleted after 30 days. Emails we send carry no student work. |
Vendors that handle account or diagnostic data only
These vendors do not receive student work, student names or student results.
| Vendor | What it does for Co-Teacher | What it receives | Location |
|---|---|---|---|
| Mixpanel | Product usage analytics | Account IDs, event names and counts, teacher email | United States |
| Sentry | Error reporting | Error traces and masked session replays, with personal data scrubbed | United States |
| Stripe | Payments | Billing details for paid plans; we never see full card numbers | United States |
| Agree.com | Electronic signature of the School Data Privacy Agreement | The school’s name and the signer’s name, title and email | United States |
| Slack | Our internal alerts and support messages | Alerts that carry no student names | United States |
How we choose and watch these vendors
- Every vendor that touches student data signs terms at least as protective as our School Data Privacy Agreement: use only for our services, confidentiality, security, no training, deletion, and breach notice to us without undue delay.
- We add an AI provider only if it meets the zero-retention standard above, and we do not use provider features that would store student data, such as prompt caching or provider-hosted evaluation tools.
- We review each vendor’s security and privacy terms before use and whenever they change.
- Changes to this list are dated at the top. Signed schools get 30 days’ notice by email before any vendor that will process student data is added or replaced.
Change log
| Date | Change |
|---|---|
| October 22, 2026 | Added Vercel (hosting and AI Gateway), TypeSafe AI, Amazon Bedrock, Google Vertex AI, Google Cloud Translation, Resend, Sentry, Agree.com and Slack, each with its role, location and retention terms. We turned on zero data retention across our AI providers, so the earlier note that providers may retain data for up to 30 days for abuse monitoring no longer applies. |
| July 13, 2026 | First published list. |
Questions: privacy@co-teacher.com. Security reports: security@co-teacher.com.
Simovia, Inc., a Delaware corporation, 2423 SW 147th Ave #2225, Miami, FL 33185.