This document is provided for informational purposes during our pre-launch period. A comprehensive, attorney-reviewed version will be published prior to the platform processing student data.
TRANSPARENCY
Subprocessor List
The third-party services that process data to deliver SPEDScribe.
Last reviewed: September 30, 2026
SPEDScribe.ai uses the following third-party service providers (subprocessors) to deliver our platform. Anthropic does not use API inputs for model training under their commercial terms; SPEDScribe does not hold a Zero Data Retention enterprise agreement. AssemblyAI processes audio under contract terms governing retention.
| VENDOR | CATEGORY | PURPOSE | DATA PROCESSED | LOCATION |
|---|---|---|---|---|
| Anthropic | AI Model Provider | Drafts clinical documentation under Anthropic's commercial terms; no training on customer data; SPEDScribe does not hold a Zero Data Retention enterprise agreement | The provider's notes after server-side redaction, with the details sent with them: discipline, session type, the student's home language and any goals the provider entered. Redaction reduces identifiers; it is not a guarantee of full removal. Anthropic retains inputs and outputs briefly for abuse detection and to meet legal obligations before deletion under their commercial terms. | United States only (stored data and model processing) |
| AssemblyAI | Speech Recognition | Audio transcription; built-in PII redaction applied to the returned transcript | Dictation audio and the transcript made from it. AssemblyAI applies its PII redaction to the returned transcript, not to the audio. Subprocessor retention behavior follows their published policies and our contract terms. | United States |
| Supabase | Database Infrastructure | Encrypted storage of the service's data (AES-256 at rest) | Account data, student records, session details, notes and observations providers type, and generated documents | United States (US West region) |
| Vercel | Hosting, Web Analytics & Speed Insights | Runs the web application, and counts page visits and measures page speed without cookies | Every request to the application, including dictation audio and notes on their way to our servers; request logs; and page addresses, some of which contain a record ID | United States (Washington, D.C. region), with a global edge network |
| Clerk | Authentication | Sign-in and account security: Google or Microsoft sign-in, or email and password | Provider name, email address, sign-in credentials, session tokens, IP address and browser details | United States and other countries where Clerk operates |
| Sentry | Error Monitoring | Production error tracking and stack-trace collection. Session replays disabled per FERPA. | Error reports with user details, cookies, request bodies and query strings removed, and email addresses, Social Security numbers and phone numbers in their common forms replaced, before sending. All Sentry events are stripped of user context before send. A name that appears inside an error message is not removed, and Sentry sees the network address each report is sent from. | United States |
| Plausible Analytics | Privacy-First Analytics | Cookieless aggregate pageview and event tracking | Page addresses, some of which contain a record ID; referrers, outbound link clicks and custom event names with no personal data props. Plausible uses a visitor's IP address and browser details to count daily visitors and does not store them. | European Union |
| Stripe | Payments | Subscription billing. Stripe also acts on its own account for fraud prevention. | The name, email address and payment details of the person who subscribes, entered on Stripe's own checkout page, and their SPEDScribe account ID. No student data. | United States and other countries where Stripe operates |
| Resend | Account Email | Sends account and billing email, such as the subscription acknowledgment | The recipient's name and email address and the content of the email. No student data. | United States |
| Upstash | Rate Limiting | Short-lived counters that limit abuse and enforce plan limits | Account IDs, organization IDs and IP addresses held in short-lived counters. No student data. | United States (US West region) |
| Google Workspace | Receives and stores email sent to our addresses at spedscribe.ai | Whatever you send us by email | United States and other countries where Google operates |
Note on GoHighLevel: GoHighLevel is NOT listed as a subprocessor because it does not process student data. It is used for demo booking and sales-contact forms, and receives what prospective customers give us: name, email, district, discipline, booking-form answers and, when someone referred them, the referrer's name.
Change Notification
We provide 30 days advance written notice before adding new subprocessors or materially changing the role of existing subprocessors. Notice is provided via email to the designated district privacy contact.
To subscribe to subprocessor change notifications, contact: support@spedscribe.ai
Questions
For questions about our subprocessors or data processing practices, contact privacy@spedscribe.ai.