Sub-processors

Note for review. This list reflects the platform architecture as designed. Before publishing, confirm each vendor is actually contracted, that a DPA is signed with each, and update the entity names and transfer mechanisms to match those signed agreements.

Core infrastructure

These process customer personal data as an inherent part of running the platform. They cannot be disabled without the service ceasing to function.

Sub-processor	Purpose	Data processed	Location	Transfer basis
Neon Inc.	Managed PostgreSQL database hosting. Stores all structured student and agency records.	All platform data	EU (Frankfurt)	UK adequacy (EEA)
Vercel Inc.	Application hosting, edge delivery and serverless compute for the platform and Student Hub.	All data in transit; transient request processing	EU (Frankfurt) with global edge	IDTA / UK SCCs
Cloudflare, Inc.	DNS, TLS termination, DDoS protection and web application firewall.	IP addresses, request metadata	Global edge network	IDTA / UK SCCs

AI and document processing

Used to generate assessment drafts, read uploaded documents and draft communications. All are engaged under enterprise terms that contractually prohibit training on customer content and prohibit retention beyond the request.

Sub-processor	Purpose	Data processed	Location	Transfer basis
Google Cloud (Gemini API)	Language model inference for assessment reports, shortlist reasoning, SOP scaffolding and drafted replies. Vision OCR for document extraction.	Student profile fields and document images, transmitted per request	EU / UK region	UK adequacy (EEA), IDTA where applicable

What we send, and what we don't. Only the fields required for a given task are transmitted — a shortlist request sends academic and budget data, not a passport scan. Document processing sends the image, receives the extracted fields, and retains nothing at the provider. No agency or student is identified to the provider by name where a reference ID will do the job.

Communication channels

These are connected at your instruction, using your own accounts. If you do not connect a channel, we do not process data through it.

Sub-processor	Purpose	Data processed	Location	Transfer basis
Meta Platforms Ireland Ltd	WhatsApp Business Platform — student messaging, milestone notifications and document chasers.	Phone numbers, message content	Ireland / US	EU SCCs + UK IDTA
Google Ireland Ltd	Gmail and Google Calendar integration where you connect a Google Workspace account — offer letter monitoring and appointment booking.	Email content, calendar entries	EU / US	UK adequacy, EU SCCs + IDTA
Microsoft Ireland Operations Ltd	Outlook and Microsoft 365 integration where you connect a Microsoft account.	Email content, calendar entries	EU / US	EU SCCs + UK IDTA
Twilio Ireland Ltd	Transactional SMS for magic-link delivery and time-critical alerts where email is unsuitable.	Phone numbers, message content	Ireland / US	EU SCCs + UK IDTA

Business operations

These process agency account and billing data, for which we act as controller. They do not have access to student records.

Sub-processor	Purpose	Data processed	Location	Transfer basis
Stripe Payments Europe Ltd	Subscription billing and payment processing. Card details go directly to Stripe and never touch our systems.	Billing contact, company details, payment data	Ireland / US	EU SCCs + UK IDTA
Sentry (Functional Software, Inc.)	Error monitoring and crash reporting, so faults are found before you report them.	Error traces with personal data scrubbed; user ID only	EU region	UK adequacy (EEA)
Plausible Analytics	Website analytics for admitai.io. Cookieless and does not track individuals across sites.	Aggregated page views; no personal identifiers	EU (Germany)	UK adequacy (EEA)

Not sub-processors

Two categories are frequently assumed to be on this list and are not:

Universities and application portals. When you submit an application, the university becomes an independent controller of that student's data. They are not our sub-processor and we have no contract with them governing their handling of it.
Affiliate partners. Accommodation, forex and insurance partners arriving with SettleIQ in Phase 3 will receive student data only where a student chooses to use that service. When they do, those partners act as independent controllers, and we will publish the arrangement here before the module ships.

Objecting to a sub-processor

You may object to a new sub-processor on reasonable data protection grounds within 30 days of our notice. Write to privacy@admitai.io setting out your concern. We will work with you on an alternative. If none can be found, you may terminate the affected part of the service without penalty and receive a pro-rata refund of prepaid fees, as set out in section 7 of our Data Processing Addendum.

Change history

Date	Change	Detail
1 August 2026	Initial publication	First version, covering the Phase 1 platform — AdmitOps and Student Hub.

We keep every prior version of this page. Ask us if you need one for your own compliance records.