Legal
Subprocessors
Last updated:
Classentra Technologies Inc., a corporation incorporated under the Canada Business Corporations Act with its registered office in Toronto, Ontario, Canada, uses the third-party subprocessors below to provide the Classentra service. Each processor's Data Processing Addendum is incorporated by reference via that processor's paid-plan Terms of Service. Standard Contractual Clauses (or the UK Addendum / IDTA / Swiss FDPIC variant where applicable) are included in those DPAs.
This list is maintained as the single source of truth for who processes personal information on Classentra's behalf. Internal copies of each processor's DPA, SOC 2 report (where available), and subprocessor list are kept under docs/legal/contracts/ in the Classentra source repository and are available to enterprise customers under NDA.
We notify enterprise customers of new or replaced subprocessors at least 30 days in advance by updating this page and by emailing the privacy contact on file. Customers may object in writing within that window; we will work in good faith to provide an alternative or terminate the affected service with a prorated refund.
Ask AI to explain
Get a quick, plain-language summary of this page without all the jargon. Opens in a new tab.
Active subprocessors
| Subprocessor | Purpose | Location of processing | Data categories | DPF certified |
|---|---|---|---|---|
| Neon, Inc. | Managed PostgreSQL database | United States (aws-us-east-1, Virginia) | All operational personal data: identity, authentication, course content, educational records, billing tokens, messages, AI prompts, telemetry | Verify |
| Vercel, Inc. | Application hosting + edge network | United States (iad1 primary; CDN global) | Personal data in transit; ephemeral runtime processing; build logs | Likely |
| Stripe, Inc. | Payment processing + Stripe Connect teacher payouts | United States (multi-region; India for INR) | Cardholder data, billing address, payout details | Yes |
| Resend, Inc. | Transactional + marketing email delivery | United States | Email address, name, message content | Verify |
| OpenAI, LLC | AI-assisted teaching features | United States (API tier; Zero Data Retention where applicable) | User prompts and AI-generated outputs | Yes |
| LiveKit Inc. | Live video infrastructure for native classes | United States (us-east) | Media streams in transit; session metadata | Verify |
| Cloudflare, Inc. (R2, Turnstile) | Object storage for recordings, materials, exports, certificates; Turnstile anti-abuse challenge on public forms | United States bucket; EU bucket added at T2 trigger | User-uploaded files and AI-generated artifacts; IP address and browser signals when a public form loads its challenge | Yes |
| Upstash, Inc. | Managed Redis for caching and rate-limit counters (planned) | United States (global edge) | Short-TTL cache entries; rate-limit counters; hot-key snapshots | Verify |
| Inngest, Inc. | Background job queue and retries (planned) | United States | Job payloads (user IDs, references) | Verify |
| Functional Software, Inc. (Sentry) | Error tracking and performance monitoring | United States | Error stack traces; scrubbed browser context; pseudonymous account identifier (no name, email, or message content) | Yes |
| Vercel Analytics | Cookie-less page analytics | United States | Aggregated page-view counts; country-level geo derived from IP. No personal identifiers. | Likely |
| PostHog Inc. | Product analytics (client-side, loaded only after consent) and account-activity telemetry (server-side, signed-in users only) | United States (us.i.posthog.com) | Session and event data captured after analytics consent; for signed-in users, server-side account-activity milestones (account created, course created, course published, checkout started, purchase completed) tied to account id, not a browsing profile, and not used for advertising | Yes |
| Namecheap Private Email | Inbound and outbound mail for support@, privacy@, billing@, and other aliases | United States | Email content and headers | Verify |
| LangChain, Inc. (LangSmith) | AI request tracing for the OpenAI-backed features (when tracing is enabled) | United States | AI prompts, AI-generated outputs, and request metadata, when tracing is enabled | Verify |
| Meta Platforms, Inc. | Teacher-configured Meta Pixel on course storefront pages (loads only after marketing consent; the teacher is the controller) | United States (global) | Pixel cookies (_fbp, _fbc), page views and purchase events on that teacher's storefront | Yes |
| Google LLC | Teacher-configured Google tag on course storefront pages (loads only after marketing consent; the teacher is the controller) | United States (global) | Analytics cookies (_ga, _gid), page views and purchase events on that teacher's storefront | Yes |
| Google LLC, Apple Inc., Mozilla Corporation (browser push services) | Delivery of web push notifications the user opted into | United States (global) | Push subscription endpoint and encrypted notification payloads (title, body, link) | Verify |
Subprocessor changes
- · Added LangChain, Inc. (LangSmith AI request tracing), Meta Platforms, Inc. and Google LLC (teacher-configured storefront pixels, consent-gated, with the teacher as controller), and the browser push services (Google, Apple, Mozilla). Widened Cloudflare's scope to include the Turnstile anti-abuse challenge on public forms.
- · Expanded Sentry's scope to include a pseudonymous account identifier, so an error report can be attributed to the number of affected accounts. No name, email address, or message content is sent.
- · Added PostHog Inc. as the product-analytics and account-activity-telemetry subprocessor. PostHog has processed visitor and account data since May 21, 2026; this list did not previously disclose it.
- · Removed Daily.co as a live-video subprocessor. LiveKit Inc. is now the sole provider of live-video infrastructure for native classes.
- · Initial publication.
Customer rights
- Object: enterprise customers may object to a new subprocessor in writing within 30 days of notice.
- Audit: customers may request annual subprocessor audit reports (SOC 2 / ISO 27001) under NDA.
- Withdraw: termination rights described in the applicable Data Processing Addendum apply.
Contact
For questions about this list, write to privacy@classentra.com. We aim to respond within 30 days.