Institutions
Subprocessors
The service providers that process personal data for us, what they do, and where.
Effective · Last updated
1. Current subprocessors
These providers process personal data on our behalf to run ITSPracticing. We are confirming that each is bound by a written agreement with appropriate data-protection obligations; the status of each agreement is being checked against our Data Processing Agreement.
| Provider | What they do | Personal data involved | Location |
|---|---|---|---|
| Neon, Inc. (on Amazon Web Services) | Primary database. Session-recording file storage: provider and region being confirmed | All Service data: accounts, institutional data, work product, activity, assessment, recordings | European Union — Frankfurt, Germany (AWS eu-central-1) |
| Vercel Inc. | Application hosting, serverless functions, content delivery | Data passing through requests; technical logs | United States, with a global edge network |
| Clerk, Inc. | Sign-in, sign-up, sessions, invitation and verification emails | Name, email, password hash, sign-in history, IP address, browser and device details | United States |
| Cloudflare, Inc. (through Clerk) | Bot protection on account creation (Turnstile) | Browser and device signals, IP address, at sign-up | Global network |
| Hangzhou DeepSeek Artificial Intelligence Co., Ltd. — only if an Institution enables AI | Generating replies for AI-played characters and the coach | The text of the learner's message and the fictional mission context; no name or email address is sent | People's Republic of China, according to the provider's published privacy policy. The same policy allows the provider to use inputs for training unless the customer opts out; we have not yet confirmed an opt-out. |
| Anthropic PBC | Drafting help for instructors in Professor Studio, when configured | The instructor's prompt and draft content, and class context that may include learners' first names | Location being confirmed |
| Resend, Inc. | Sending email | Recipient email address and the content of the message | Location being confirmed (a United States company) |
| Hetzner Online GmbH | Practice workspaces, and the self-hosted tools used in missions | Work done inside practice workspaces, and the accounts of the self-hosted tools | Germany |
| Cloudflare, Inc. (Workers, for ITS CAD) | Hosting for the ITS CAD tool | Technical data from using the tool; what is stored is being confirmed | Global network |
2. Services you choose to use
If you choose “Continue with Google”, Google LLC confirms your identity and shares your name and email address with us. Google acts as an independent controller under its own privacy policy, not as our subprocessor.
3. Changes
We will update this page before a new subprocessor starts processing personal data, and Institutions that have signed our Data Processing Agreement will be notified at least 30 days in advance of changes we make, with the right to object as set out in that agreement. For a change a provider makes itself, we tell them as soon as we are told. To be notified, or for copies of transfer safeguards, write to privacy@itspracticing.com.