Subprocessor List
GradeLogic™ relies on a small set of third-party subprocessors to operate. Each processes data only to provide its function. Because GradeLogic™ is local-first, rosters, identity mappings, original exams, and accepted results are designed to remain in the browser. Paid cloud operations receive only instructor-approved assessment excerpts after local PII review, subject to the redaction limitations described below.
Current subprocessors
| Subprocessor | Purpose | Data processed | Region |
|---|---|---|---|
| Cloudflare | Hosting, serverless backend and database; Turnstile anti-bot checks on our public forms | Transient redacted operation payloads; account/session metadata; for Turnstile, the IP address and user-agent of anyone submitting the waitlist or newsletter form | Global edge |
| Sign-in | Google profile basics (name, email, picture) | Global | |
| Sentry | Backend error monitoring; optional browser error and performance diagnostics | Backend error messages and stack traces, redacted API routes, request methods, request IDs, and runtime metadata. Optional browser diagnostics can also include the IP address and user-agent received at the network layer, page route, browser and device metadata, workflow phase and outcome, instructor-attended time, request timing, performance measurements, and random internal user or billing-account IDs used for correlation. Names, email addresses, exam and task identifiers, cookies, request or response bodies and headers, query parameters, exam files, roster records, answer images, prompts, and model output are excluded from backend events and are not intentionally attached to browser events. | EU ingest endpoint (Germany) |
| OpenRouter | AI gateway — routes each operation to the model provider below | Instructor-approved, client-redacted assessment content; unexpected PII may remain if it was missed during review | US |
| Model providers (see below) | Paid AI operations (OCR, zone detection, answer parsing, grading) | Instructor-approved, client-redacted assessment content; unexpected PII may remain if it was missed during review | See below |
| Stripe | Payments & subscriptions | Billing and account identifiers; payment details | US / EU |
Stripe test mode is used only for controlled sandbox evaluation. Public purchasing and live payment processing are not enabled.
Model providers
AI operations are routed through OpenRouter to the model best suited to each task. Which model that is changes as better ones become available — we route to frontier models and replace them when they are superseded — so this section describes the category of recipient and where it processes, rather than pinning a vendor or a version.
Currently in use: large-language-model providers, reached through OpenRouter. Which provider serves a given operation, and where it runs, follows that routing and changes with it.
We name the individual providers and their current processing locations to institutional customers under our Data Processing Agreement, which is where the right to be told who processes your students' data — and to object to a change of processor — belongs. Write to privacy@gradelogic.ai for the current list.
Transfers outside the EEA
Assessment content sent for a paid cloud operation leaves the EEA in every case. The AI gateway in the table above operates from the United States, and every request passes through it whatever your settings say. The European Commission has not issued an adequacy decision for that transfer.
What the processing setting under Settings › AI Configuration changes is the model provider at the end of that route. Under the restricted option we route only to providers we reach under our EEA restriction; under the unrestricted option the content may be processed anywhere, including in countries with no adequacy decision. Accounts we cannot positively place outside the EEA — including any account whose country we have not yet established — are held to the restricted option and cannot change it.
In either case content is prepared client-side to exclude marked identity regions, but the server cannot independently verify that every direct or unexpected identifier was removed. Even when direct identifiers are removed, exam answers written by a student remain personal data in pseudonymised form.
If your institution's policy restricts where assessment content may be processed, or you are subject to school data-protection rules that limit transfers outside the EEA, set the restricted option before running paid cloud operations. Contact us at privacy@gradelogic.ai if you need the current processing locations in writing.
Changes
We keep this list current and will update it before, or promptly after, engaging a new subprocessor. Because the individual model providers are named under the Data Processing Agreement rather than here, a change of model provider is notified through that channel to the customers entitled to object to it. Once this document takes effect, material changes will be reflected by its effective date.
Contact
Subprocessor questions: privacy@gradelogic.ai.