This page lists every provider that processes data for ANAX Schools, as the service is actually built. Internal tools that never touch school data (for example source-code hosting) are not listed. Where a provider's processor terms are not yet in force, or we have not yet confirmed that they apply to our own account, this page says so. The safeguards listed are those described in each provider's published terms; for Fly.io and Google Workspace we cannot yet say that a confirmed safeguard is in place for our own account.
Providers in force for the assessment service
| Provider | Service and purpose | Data it can see | Verified location | Transfer relevance | Terms in force | Effective / review |
|---|---|---|---|---|---|---|
| Fly.io | Hosting of the assessment form, review queue and governance route (London) and the assessment engine (Amsterdam); TLS termination; request logs | Application data in transit and in machine memory; IP addresses in logs | London (UK) and Amsterdam (Netherlands); Fly.io's corporate systems in the United States | UK → Netherlands under UK adequacy regulations; UK → US for corporate access (Fly.io states EU-US Data Privacy Framework with UK Extension and SCCs with its vendors) | Not yet in place. Fly.io's terms of service do not include a data processing agreement; the agreement is a separate document. Its first signature recorded our company's name incompletely, and a corrected agreement is awaited. This page will change when it is in force. | reviewed 12 Oct 2026 |
| Supabase Pte. Ltd | Managed Postgres database (Pro plan) holding engagement codes, answers, Passports and anonymous statistics; read-only verification views; daily backups, kept for 7 days | All stored assessment data | Our project's selected region, AWS eu-west-1 (Ireland), verified 11 Oct 2026. Supabase's addendum describes limited processing outside the selected region, for example for support and operations | UK → Ireland under UK adequacy regulations; any processing outside the region under the safeguards in Supabase's addendum | In force by the Supabase Terms of Service, which include its data processing addendum with EU standard contractual clauses and the UK Addendum | reviewed 1 Nov 2026 |
| Vercel Inc. | Static hosting of the Passport verification page and the public website (Pro plan) | Visitor IP addresses and request details in its runtime logs, kept for one day; no assessment data (the verification page reads Passports from our database directly in your browser) | Global edge network; corporate systems in the United States | UK → US under Vercel's data processing addendum for Pro and Enterprise customers (SCCs and UK transfer mechanisms) | In force by the Agreement | reviewed 1 Nov 2026 |
| Google (Google Workspace) | Mailbox for contact@viccaone.com and business administration: correspondence about engagements, accounts and support | Names and work email addresses of school and trust contacts, and what is written in the correspondence | Google data centres | Google Cloud Data Processing Addendum, offered through the Workspace terms | Not yet confirmed. Google offers its Cloud Data Processing Addendum through the Workspace terms; that it is shown as accepted in our Admin console has not yet been confirmed | reviewed 1 Nov 2026 |
When an organisation uses the signed-in register
The AI tools register (schools and trusts signing in, keeping their register, decisions, actions and reviews) is provided to an organisation when it is set up on the service. From then, the following applies in addition; until an organisation has been set up on it, nothing below is in use.
| Provider | Additional service and purpose | Additional data it can see | Location | Status | |
|---|---|---|---|---|---|
| Supabase Pte. Ltd | The same database also holds each organisation's register, decisions, actions, reviews, memberships and invitations (as hashes). Supabase Auth signs people in: it holds each signed-in person's email address and asks for the sign-in link email to be sent; our service stores only the account identifier it issues, never a password and never the email address | The email addresses of the people who sign in; the governance records described in the privacy notice | The same project in AWS eu-west-1 (Ireland), with the limited processing outside the region described above | Same terms as above | |
| Brevo | Delivers the register's sign-in emails and its governance notification emails (invitations, reminders, decisions needed, weekly trust summaries), from ANAX Schools <no-reply@auth.anaxstandard.ai>. Transactional service email only; no marketing | The email address an email is sent to, and the email itself (a notification names the organisation, the AI tool and dates; it carries no assessment answers or results) | Brevo states that it hosts and stores data in the European Union (France, Germany and Belgium) | UK → EU under UK adequacy regulations | In force: Brevo's data processing agreement forms part of its terms of service |
Apart from Brevo for the sign-in and notification emails, the register adds no provider: it is served by the same Fly.io application.
No model provider
Since 3 November 2026 the assessment engine is deterministic and calls no artificial-intelligence or large-language-model service, so no model provider is a sub-processor of ANAX Schools. Before that date, an advisory step in an earlier version of the engine used Anthropic's API (Anthropic Ireland, Limited; operated from the United States), which received a school's name, the framework identifier and summary scores — never answers, free text, contact details or pupil data. Anthropic receives no data from ANAX Schools for any assessment run since.
Disclosed but not a processor
Google Fonts. The Passport verification page loads its typefaces from fonts.googleapis.com and fonts.gstatic.com. Your browser sends your IP address to Google for those requests. Google processes that request under its own privacy policy; it is not our processor. The assessment page, the register and the legal pages load no fonts from Google.
Changes
We give engaged schools and trusts at least 30 days' notice before adding or replacing a provider, by email to the organisation's contact and by updating this page. When a provider stops processing data for the service, we remove it here and record that in the version history. This page is versioned; the version and review date appear in its header.
Version history: 1.0 (12 October 2026); 1.1 (26 October 2026) — what changes when the signed-in register is enabled (Supabase Auth, the sign-in email relay still to be evidenced). 1.2 (1 November 2026) — Brevo for the register's sign-in emails; Supabase Pro, its selected region with limited processing outside it, and 7-day backups; Vercel Pro and one-day logs; the Fly.io agreement's corrected signature awaited; the Google addendum's acceptance not yet confirmed. 1.3 (3 November 2026) — Anthropic removed: the engine is deterministic and calls no model provider since 3 November 2026; the register's providers apply once an organisation is set up on it. 1.4 (4 November 2026) — Brevo also delivers the register's governance notification emails.