LEGAL · SUB-PROCESSOR REGISTER

Asabya Academy Sub-processors

Third parties who process personal data on behalf of schools using Asabya Academy, as referenced in Annex B of our Data Processing Agreement.

Last updated: 2026-06-23

Database and authentication
Supabase, Inc.
Stores all platform data; manages user authentication
Country of incorporation
United States
Region of processing
Mumbai, India (ap-south-1)
Certifications
SOC 2 Type II · HIPAA-eligible
Engaged since
May 2026
Application hosting and content delivery
Vercel Inc.
Serves the web application to end users
Country of incorporation
United States
Region of processing
Global edge network (primary: US)
Certifications
SOC 2 Type II · ISO 27001
Engaged since
May 2026
Transactional email
Resend, Inc. (using Amazon SES)
Sends platform-generated emails
Country of incorporation
United States
Region of processing
Tokyo, Japan (primary); US (failover)
Certifications
SOC 2 Type II (AWS) · ISO 27001 (AWS)
Engaged since
May 2026
DNS and edge security
Cloudflare, Inc.
DNS resolution; edge security; anti-DDoS; encrypted off-site backup storage (R2)
Country of incorporation
United States
Region of processing
Global edge network
Certifications
SOC 2 Type II · ISO 27001 · ISO 27018
Engaged since
May 2026
Automated backup processing (CI)
GitHub, Inc. (a Microsoft company)
Executes the automated backup pipeline — the database is transiently dumped and encrypted within GitHub-hosted runners before upload; plaintext exists only transiently in-runner, and stored output is encrypted.
Country of incorporation
United States
Region of processing
GitHub-hosted runners (US/global)
Certifications
SOC 1 Type II · SOC 2 Type II · ISO 27001
Engaged since
June 2026

SUBSCRIBE TO UPDATES

Schools will be notified of any addition or replacement of a sub-processor (DPA § 3.6). To receive notifications at an additional email address, subscribe below.

CHANGE HISTORY

2026-06-23Cloudflare role expanded to include encrypted off-site backup storage (R2); GitHub, Inc. added as a sub-processor executing the automated backup pipeline. Backup objects are encrypted by Asabya (AES-256) before upload; Cloudflare stores only ciphertext it cannot read.
2026-05-25DPA updated to v2.0; sub-processor list migrated to database for versioning.
2026-05-21Initial register published with Phase 7 DPA