Sub-processors
Current list version: SPL-2026.08 · Effective: August 2026 · Document owner: Antony Dennis, Director
This is the canonical sub-processor list for VESPA Academy. The Data Processing Agreement Schedule 2 snapshots this version at issue. A change to this list triggers the DPA notice-and-objection process (30 days). A change to the DPA body itself triggers a new DPA version and re-acceptance — tracked separately as dpa_version vs subprocessor_list_version in our CRM.
Current list (SPL-2026.08)
| Sub-processor | Purpose | Location / transfer |
|---|---|---|
| Supabase | Application database, authentication, storage | EU (Stockholm, eu-north-1) |
| Vercel | Application hosting and serverless APIs | US (iad1) — SCCs |
| SendGrid (Twilio) | Transactional email | US (SCCs) |
| Stripe | Payment processing (where used) | EU / US (SCCs / PCI DSS) |
| OpenAI | Optional portal AI features (API) | US (SCCs) |
| Anthropic | 4Sight CRM / internal operations only | US / global (SCCs) |
| Wonde | MIS integration (where enabled) | UK |
| Microsoft Graph / Google Admin SDK | Directory sync (when school connects) | Per provider / SCCs |
| Cookiebot (Usercentrics) | Marketing-site cookie consent | EEA / provider terms |
| Google Analytics (GA4) | Marketing-site analytics (consent-gated) | US / global (SCCs) |
| Meta / LinkedIn / Google Ads tags | Marketing-site advertising measurement (consent-gated; not in portal) | US / global (SCCs) |
| Weglot | Optional translation | Per provider terms |
| FL4SH / fl4sh.cards | Flashcard generation where enabled | Per hosting arrangement |
Changelog
| Version | Date | Change |
|---|---|---|
| SPL-2026.08 | August 2026 | Initial versioned public list aligned to DPA v2.0. Vercel region stated as US iad1 (verified). Anthropic scoped to CRM/internal. Marketing consent tools and ad tags listed. Knack removed (SaaS closed; not a live sub-processor). |
| SPL-2026.08 (clarification) | August 2026 | Anthropic location clarified from “US (SCCs)” to “US / global (SCCs)” to reflect unrestricted inference geo / global routing in the Anthropic console (requests may be processed outside the US). No new sub-processor added. |
Questions: admin@vespa.academy. Related: DPA · Policies index.
© 2026 VESPA Academy — 4Sight Education Ltd.