This document is provided for informational purposes during our pre-launch period. A comprehensive, attorney-reviewed version will be published prior to the platform processing student data.
TRANSPARENCY
Subprocessor List
The third-party services that process data to deliver SPEDScribe.
Last reviewed: September 30, 2026
SPEDScribe.ai uses the following third-party service providers (subprocessors) to deliver our platform. Anthropic does not use API inputs for model training under their commercial terms; SPEDScribe does not hold a Zero Data Retention enterprise agreement. AssemblyAI processes audio under contract terms governing retention.
| VENDOR | CATEGORY | PURPOSE | DATA PROCESSED | LOCATION |
|---|---|---|---|---|
| Anthropic | AI Model Provider | Drafts clinical documentation under Anthropic's commercial terms; no training on customer data; SPEDScribe does not hold a Zero Data Retention enterprise agreement | The provider's notes after server-side redaction, with the details sent with them: discipline, session type, the student's home language, any goals the provider entered, the session's length and voice-command counts when there are any, and the session's earlier documents the new one builds on; for a PLAAFP or annual goals, also the student's grade level and the session's date, which those documents then carry. Redaction reduces identifiers; it is not a guarantee of full removal. Anthropic retains inputs and outputs for up to 30 days, or longer if flagged for safety review, for abuse detection and to meet legal obligations before deletion under their commercial terms. | United States only (stored data and model processing) |
| AssemblyAI | Speech Recognition | Audio transcription; built-in PII redaction applied to the returned transcript | Dictation audio and the transcript made from it. AssemblyAI applies its PII redaction to the returned transcript, not to the audio. Subprocessor retention behavior follows their published policies and our contract terms. | United States |
| Supabase | Database Infrastructure | Encrypted storage of the service's data (AES-256 at rest) | Account data, student records, session details, notes and observations providers type, and generated documents | United States (US West region) |
| Vercel | Hosting, Web Analytics & Speed Insights | Runs the web application, and counts page visits and measures page speed without cookies | Every request to the application, including dictation audio and notes on their way to our servers; request logs; and page addresses, some of which contain a record ID | United States (San Francisco region), with a global edge network |
| Clerk | Authentication | Sign-in and account security: Google or Microsoft sign-in, or email and password | Provider name, email address, sign-in credentials, session tokens, IP address and browser details | United States and other countries where Clerk operates |
| Sentry | Error Monitoring | Production error tracking and stack-trace collection. Session replays are disabled. | Error reports with user details, cookies, request bodies and query strings removed, and email addresses, Social Security numbers and phone numbers in their common forms replaced, before sending. All Sentry events are stripped of user context before send. A name that appears inside an error message is not removed, and Sentry sees the network address each report is sent from. | United States |
| Plausible Analytics | Privacy-First Analytics | Cookieless aggregate pageview and event tracking | Page addresses, some of which contain a record ID; referrers, outbound link clicks and custom event names with no personal data props. Plausible uses a visitor's IP address and browser details to count daily visitors and does not store them. | European Union |
| Stripe | Payments | Subscription billing. Stripe also acts on its own account for fraud prevention. | The name, email address and payment details of the person who subscribes, entered on Stripe's own checkout page, and their SPEDScribe account ID. No student data. | United States and other countries where Stripe operates |
| Resend | Account Email | Sends account and billing email, such as the subscription acknowledgment | The recipient's name and email address and the content of the email. No student data. | United States |
| Upstash | Rate Limiting | Short-lived counters that limit abuse and enforce plan limits, and a marker that lasts a few minutes while a document is being written | Account IDs, organization IDs and IP addresses held in short-lived counters, and a session's record ID while one of its documents is being written. No student data. | United States (N. Virginia) |
| Google Workspace | Receives and stores email sent to our addresses at spedscribe.ai | Whatever you send us by email | United States and other countries where Google operates | |
| GoHighLevel | CRM | Our CRM for demo requests, reached from our server | What prospects enter in our demo request form: name, email address, school or district, and role or discipline | Not verified |
| Cloudflare Turnstile | Captcha | Captcha at sign-up, run through Clerk | The visitor's IP address and browser and connection details, which Turnstile uses to tell people from bots | Not verified |
Note on GoHighLevel: GoHighLevel is NOT listed as a subprocessor because it does not process student data. It is used for demo booking and sales-contact forms, and receives what prospective customers give us: name, email, district, discipline and booking-form answers.
Change Notification
We provide 30 days advance written notice before adding new subprocessors or materially changing the role of existing subprocessors. Notice is provided via email to the designated district privacy contact.
To subscribe to subprocessor change notifications, contact: support@spedscribe.ai
Questions
For questions about our subprocessors or data processing practices, contact privacy@spedscribe.ai.