Sub-processors

The third parties Scholé engages to process personal data on behalf of its customers, as referenced in section 8 of the Data Processing Agreement.

Scholé company responsible: Scholé Sàrl (EPFL, Bâtiment INF, Station 14, 1015 Lausanne, Switzerland) for customers and learners in Switzerland, the EEA and the United Kingdom; Scholé Inc. (1209 Orange Street, Wilmington, Delaware 19801, USA) for the United States and everywhere else, including Canada, as in Terms of Service section 1.

Version 2026-10-01 · last updated 2026-10-01 · machine-readable copy: /sub-processors.json · questions and objections: privacy@schole.ai

We give customers at least 30 days' written notice before adding or replacing a sub-processor, per DPA section 8. Entries marked to be confirmed are being verified with the provider and will be updated here.

Transfer basis for US entities is stated as the mechanism we rely on in principle; per-provider DPA and Data Privacy Framework certification status is being verified and filed (see 'to be confirmed').
LLM inference requests routed through OpenRouter may reach only the seven hosts listed under OpenRouter below (settings.OPENROUTER_PROVIDER_ALLOWLIST, PR #3342): every request carries provider.only with that allowlist, data_collection=deny and zdr=true (OpenRouter's Zero Data Retention filter), and the same policy is enforced on the wire for every HTTP client pointed at OpenRouter. The per-host data policy shown below is OpenRouter's published data policy (openrouter.ai/api/frontend/v1/all-providers and /api/v1/endpoints/zdr, read 2026-09-27), not a contractual commitment to Scholé (DPIA R3).
Cardholder data is entered on Stripe-hosted pages and never reaches Schole systems.
MiniMax, StreamLake, SiliconFlow and DekaLLM, Black Forest Labs (FLUX.2 Pro image generation), and the first-party OpenAI and Anthropic endpoints are not on the allowlist and receive no data through OpenRouter (PR #3342, founders' decision of 2026-09-27). FLUX.2 Pro stays off until Black Forest Labs confirms a training opt-out for OpenRouter traffic; lesson illustrations use google/gemini-2.5-flash-image on Google Vertex AI.
Known uncertainty: OpenRouter does not publish which region serves its requests. The Microsoft Azure, Google Vertex AI and Amazon Bedrock slugs also match those companies' global endpoints (any region), and GroqCloud serves from the United States, Helsinki (EU), Canada and Dammam (Saudi Arabia, no adequacy decision). Serving region to be confirmed.

Current sub-processors

Sub-processor	Country	Region of processing	Purpose	Data categories	Transfer basis	Added
Microsoft Azure (hosting) Microsoft Ireland Operations Ltd	IE	Switzerland North (AKS cluster, PostgreSQL, Blob Storage, Front Door, Key Vault, Log Analytics, Video Indexer, AI Search)	Platform hosting: application servers, database, file and media storage, edge network, logs and metrics, video indexing and search indexes	All platform data: account and profile data, learning content and conversations, role-play transcripts, uploaded documents, telemetry, backups	Swiss/EU adequacyDPA: Microsoft Products and Services DPA (to be confirmed on file)	2026-09-25
Microsoft Azure AI (Azure OpenAI, Azure AI Foundry, Document Intelligence) Microsoft Corporation	US	Azure OpenAI and AI Foundry accounts in East US 2, Central US and Switzerland North; 29 of 30 deployments are GlobalStandard, so inference may run in any Azure region while data at rest stays in the account region. Document Intelligence in West Europe. Two Azure Speech accounts exist (East US and Switzerland North, resource group ScholéAvatar) but no code in the schole_backend repository calls them as of 2026-09-25. Inference region decision pending (issue #3279)	AI inference: lesson and chat generation when OpenRouter is disabled or as fallback, embeddings, realtime voice (gpt-realtime), text-to-speech (gpt-4o-mini-tts), Anthropic models via Azure AI Foundry, document text extraction (Document Intelligence)	Conversation content and prompts Profile-derived context embedded in prompts (role, goals, skills) Voice audio for realtime sessions Text of uploaded documents	EU SCCs + UK Addendum + Swiss addendum; DPF where certified (to be confirmed)DPA: Microsoft Products and Services DPA (to be confirmed on file)	2026-09-25
OpenRouter OpenRouter, Inc. Model vendors (whose models are used; they receive data only if listed as a host below): OpenAI: gpt-oss-120b, gpt-oss-20b (open weights), gpt-4o, gpt-4o-mini, gpt-5.4, gpt-5.4-mini Served by: Microsoft Azure (gpt-4o, gpt-4o-mini, gpt-5.4, gpt-5.4-mini); Cerebras, Groq, SambaNova, Nebius, Amazon Bedrock and Google Vertex AI (gpt-oss). OpenAI's own endpoint is not allowed and receives no data through OpenRouter. Google: gemini-3.5-flash, gemini-2.5-flash (speech-to-text), gemini-2.5-flash-image (lesson illustrations), gemini-3.1-flash-tts-preview Served by: Google Vertex AI only; Google AI Studio (retains prompts 55 days) is not allowed. Anthropic: claude-sonnet-4.6, claude-sonnet-5, claude-opus-4.8, claude-fable-5 Served by: Amazon Bedrock and Google Vertex AI (and Microsoft Azure for claude-fable-5). Anthropic's own endpoint is not allowed and receives no data through OpenRouter. Downstream providers: Cerebras (`cerebras`): inference host for gpt-oss-120b; first choice on the role-play voice path Cerebras Systems Inc. Country: US · region: United States; Cerebras also runs a site in Montreal, Canada (Canada has EU and Swiss adequacy for commercial organisations) and plans one in France; OpenRouter does not state which serves a request Data policy published by OpenRouter: No training, no retention, ZDR endpoint Transfer basis: Onward transfer by OpenRouter under Scholé's terms with OpenRouter (EU SCCs + UK Addendum + Swiss addendum, to be confirmed) and OpenRouter's terms with the provider; no direct contract between Scholé and this provider; DPF status to be confirmed Groq (`groq`): inference host for gpt-oss-120b and gpt-oss-20b; role-play failover Groq, Inc. Country: US · region: Not disclosed (known uncertainty): GroqCloud serves from the United States, Helsinki (EU), Canada and Dammam (Saudi Arabia), and OpenRouter does not publish which region serves its traffic Data policy published by OpenRouter: No training, no retention, ZDR endpoint Transfer basis: Onward transfer by OpenRouter under Scholé's terms with OpenRouter (EU SCCs + UK Addendum + Swiss addendum, to be confirmed) and OpenRouter's terms with the provider; no direct contract between Scholé and this provider; DPF status to be confirmed; if served from Saudi Arabia, no adequacy decision: SCCs required, to be confirmed Serving region not disclosed; may include Saudi Arabia, which has no adequacy decision SambaNova (`sambanova`): inference host for gpt-oss-120b; role-play failover SambaNova Systems, Inc. Country: US · region: United States (data centre not stated by OpenRouter) Data policy published by OpenRouter: No training, no retention, ZDR endpoint Transfer basis: Onward transfer by OpenRouter under Scholé's terms with OpenRouter (EU SCCs + UK Addendum + Swiss addendum, to be confirmed) and OpenRouter's terms with the provider; no direct contract between Scholé and this provider; DPF status to be confirmed Nebius (`nebius`): inference host for gpt-oss-120b; role-play failover Nebius Group N.V. (Nebius Token Factory) Country: NL · region: to be confirmed (Nebius operates data centres in Finland, France, Iceland and the United States; OpenRouter does not state which serves this endpoint) Data policy published by OpenRouter: No training, no retention, ZDR endpoint Transfer basis: EEA entity: Swiss/EU adequacy when served from an EEA data centre; if served from the United States, SCCs required (serving region to be confirmed) Microsoft Azure (via OpenRouter) (`azure`): only allowed host for gpt-4o, gpt-4o-mini, gpt-5.4 and gpt-5.4-mini; also a host for claude-fable-5. OpenRouter's own Azure capacity, separate from Scholé's Azure accounts listed above Microsoft Corporation Country: US · region: Any Azure region: the base slug also matches azure/global endpoints; regional endpoints (azure/us, azure/eu, azure/swedencentral) exist for some models Data policy published by OpenRouter: No training, no retention, ZDR endpoint Transfer basis: Onward transfer by OpenRouter under Scholé's terms with OpenRouter (EU SCCs + UK Addendum + Swiss addendum, to be confirmed) and OpenRouter's terms with the provider; no direct contract between Scholé and this provider; DPF status to be confirmed Google Vertex AI (`google-vertex`): host for Gemini models (chat, speech-to-text, lesson illustrations with gemini-2.5-flash-image, text-to-speech) and for Claude and gpt-oss models Google LLC Country: US · region: Any Google region: the base slug also matches google-vertex/global, and gemini-2.5-flash-image has only a global endpoint; regional endpoints (us, eu, europe) exist for some models Data policy published by OpenRouter: No training, no retention, ZDR endpoint Transfer basis: Onward transfer by OpenRouter under Scholé's terms with OpenRouter (EU SCCs + UK Addendum + Swiss addendum, to be confirmed) and OpenRouter's terms with the provider; no direct contract between Scholé and this provider; DPF status to be confirmed Amazon Bedrock (AWS, via OpenRouter) (`amazon-bedrock`): host for Claude models and gpt-oss models. OpenRouter's own Bedrock capacity, separate from the browser-extension AWS account listed below Amazon Web Services, Inc. Country: US · region: Any AWS region: the base slug also matches amazon-bedrock/global cross-region inference; eu-west-1 and US endpoints exist for some models Data policy published by OpenRouter: No training, no retention, ZDR endpoint Transfer basis: Onward transfer by OpenRouter under Scholé's terms with OpenRouter (EU SCCs + UK Addendum + Swiss addendum, to be confirmed) and OpenRouter's terms with the provider; no direct contract between Scholé and this provider; DPF status to be confirmed Every OpenRouter inference request carries provider.only = the seven allowlisted hosts below (a caller can narrow the list, never widen it), data_collection=deny and zdr=true, and keeps its preferred order and throughput sort within that list; if no allowed host is left the request fails before it leaves Scholé. The role-play voice path prefers Cerebras, SambaNova, Groq and Nebius. anthropic/claude-fable-5 has no endpoint-level ZDR record on OpenRouter and is sent without zdr, but only to allowlisted hosts that publish no retention. Not enforceable per request, so covered by OpenRouter's account-wide privacy settings (to be set by the account owner): text-to-speech (/audio/speech, whose only host is Google Vertex AI), the knowledge-base sidecar and the web-search plugin.	US	United States (routing); inference by one of the seven allowlisted hosts below, in a region the host chooses (not pinned; see each host)	LLM request routing for lesson generation, tutoring chat, role-play voice agents and content authoring (OPENROUTER_ENABLED=true in production)	Conversation content and prompts Profile-derived context embedded in prompts	EU SCCs + UK Addendum + Swiss addendum; DPF where certified (to be confirmed)DPA: to be confirmed	2026-09-25
Groq (direct API) Groq, Inc.	US	United States	Speech-to-text (Whisper large-v3) for chat voice input and role-play voice, called directly at api.groq.com when GROQ_API_KEY is configured; also the OpenAI-compatible fallback endpoint when no Cerebras key is set	Learner voice audio clips Prompts on the fallback text path	EU SCCs + UK Addendum + Swiss addendum; DPF where certified (to be confirmed)DPA: to be confirmed	2026-09-25
OpenAI (direct API) OpenAI, L.L.C.	US	United States	Speech-to-text fallback (whisper-1) at api.openai.com when the Groq transcription path fails	Learner voice audio clips	EU SCCs + UK Addendum + Swiss addendum; DPF where certified (to be confirmed)DPA: to be confirmed	2026-09-25
Cerebras (direct API) Cerebras Systems Inc.	US	United States	Direct OpenAI-compatible inference endpoint (gpt-oss-120b) for a legacy routing path when CEREBRAS_API_KEY is configured	Prompts and conversation content on that path	EU SCCs + UK Addendum + Swiss addendum; DPF where certified (to be confirmed)DPA: to be confirmed	2026-09-25
Amazon Web Services (browser-extension agent only) Amazon Web Services EMEA SARL	LU	eu-central-1 (Frankfurt)	Amazon Bedrock (Anthropic Claude Haiku) inference, Amazon Transcribe and Amazon Polly for the Ole browser-extension companion agent. Not used by the web platform.	Companion-agent conversation content and page context the learner shares Voice audio for the extension's voice mode	Swiss/EU adequacyDPA: AWS GDPR DPA (to be confirmed on file)	2026-09-25
PostHog PostHog, Inc.	US	EU cloud, Frankfurt (eu.i.posthog.com), project 92916; a separate US-cloud project "Schole Studies" serves the pre-test study site (backend/config/settings.py comment; apps/curriculums/services/end_survey.py)	Product analytics and in-product surveys; consent-gated for analytics events	Usage events keyed on the profile id Signup email AI prompt and response text where the learner has accepted analytics	EU SCCs + UK Addendum + Swiss addendum; DPF where certified (to be confirmed)DPA: to be confirmed	2026-09-25
Sentry Functional Software, Inc.	US	EU data residency, Frankfurt (ingest.de.sentry.io)	Error and performance monitoring for the backend and the web app	Error context: user id, request path, stack traces IP address and user agent	EU SCCs + UK Addendum + Swiss addendum; DPF where certified (to be confirmed)DPA: to be confirmed	2026-09-25
HubSpot HubSpot, Inc.	US	United States (data hosting region to be confirmed)	CRM, lifecycle and marketing email, support tickets; marketing consent mirrored from ConsentRecord	Name, email, company and role Lifecycle and marketing consent state Support conversations	EU SCCs + UK Addendum + Swiss addendum; DPF where certified (to be confirmed)DPA: to be confirmed	2026-09-25
Stripe Stripe Payments Europe, Ltd.	IE	European Union (Stripe may process in the United States under its own transfer mechanisms)	Subscription payments and invoicing. Cardholder data is entered on Stripe-hosted pages and never reaches Schole.	Billing identity: name, email, Stripe customer id Subscription and invoice records	Swiss/EU adequacyDPA: Stripe Data Processing Agreement (to be confirmed on file)	2026-09-25
Mercury (bank-transfer invoices) Mercury Technologies, Inc.	US	United States	Invoice creation and payout reconciliation for organizations paying by bank transfer	Organization billing contact name and email	EU SCCs + UK Addendum + Swiss addendum; DPF where certified (to be confirmed)DPA: to be confirmed	2026-09-25
Certifier (credential issuing) Certifier sp. z o.o. (Kraków, Poland; KRS 0000863560)	PL	AWS, Europe region, according to Certifier's legal and security page (exact AWS region to be confirmed)	Hosts the credentials issued before the in-house credential cutover at credsverse.com (Certifier's credential domain); 436 vendor-era credentials stay live there. New issuing through Certifier is off in production (CERTIFIER_ENABLED=False in infra/k8s/overlays/prod/configmap-backend-patch.yaml); badges now issue from Scholé's own verification page	Learner name and email on the legacy credentials Lesson title and issue date	Intra-EEA (Poland): no third-country transfer from the EEA; Swiss/EU adequacy for Swiss dataDPA: Certifier DPA (to be confirmed on file)	2026-09-25
Google Workspace Google LLC	US	United States and European Union	Company email (transactional mail is sent through the hey@schole.ai mailbox), shared documents and drives, Google sign-in (OAuth)	Email correspondence including data subject requests and support mail Recipient addresses of transactional email Google account identifier for learners who sign in with Google	EU SCCs + UK Addendum + Swiss addendum; DPF where certified (to be confirmed)DPA: Google Cloud / Workspace Data Processing Addendum (to be confirmed on file)	2026-09-25
GitHub GitHub, Inc.	US	United States	Source code hosting, CI pipelines, issue tracking and automated review	No learner data by design; incidental personal data in issue text, CI logs and configuration Staff and contractor accounts	EU SCCs + UK Addendum + Swiss addendum; DPF where certified (to be confirmed)DPA: GitHub Data Protection Agreement (to be confirmed on file)	2026-09-25
Golpo AI Golpo (legal entity to be confirmed)	to be confirmed	Not yet confirmed. The code calls api.golpoai.com through the golpo SDK and shows nothing about where Golpo processes or stores data	Whiteboard explainer video generation for lesson sections (apps/lesson_lab/services/golpo.py): the section is uploaded as a JSON file and Golpo returns a narrated video and its script. Used for customer-authored lessons in Lesson Lab when an author asks for a video, and for Scholé's own lessons. The video is served from the URL Golpo returns	Lesson section text sent for each video (title, description, subsections, learning goals); for customer-authored lessons this is customer content, with personal data only where an author put it in the lesson The generated narration script and video	To be confirmed once Golpo's location and processing region are known; EU SCCs + UK Addendum + Swiss addendum if outside an adequacy decisionDPA: to be confirmed	2026-10-01

Internal systems (not sub-processors)

Run on infrastructure Scholé controls; listed for completeness because they hold the same kinds of data.

System	Hosting	Purpose	Data categories	Why it is not a sub-processor
Langfuse (LLM tracing, being removed, PR #3325)	Self-hosted on the nonprod AKS cluster, Switzerland North (langfuse.dev.schole.ai), and receives production traces. Being removed entirely (issue #3280, PR #3325)	Traces of LLM calls for debugging and quality review	Prompts and model responses Internal user and conversation identifiers	Runs on Schole-controlled infrastructure; no third party receives the data.