- Published version: 2026-10-07 · Effective since: 2026-06-03 · Next review: 2027-10-07 (at least annually + event-driven on any sub-processor change).
- Total: 40 entries: 12 sub-processors that receive personal information, and 28 providers listed for transparency that receive no student PII.
- Residency: the student data RevolutionEd stores is kept in the United States. The Residency column shows where each provider processes the data it receives; providers marked Global can process it outside the United States (see where data is stored and processed).
- No sale: none of our sub-processors may sell personal information or use it for advertising; each that receives personal information from us is bound to a no-less-protective written agreement.
- Key: PII means personally identifiable information (personal or student data); a DPA is the Data Privacy Agreement that contractually binds each sub-processor that receives it.
Server-side (backend service)
| Sub-processor | Function | Residency | Receives personal information? |
|---|---|---|---|
| Google Cloud Platform | Hosting (Cloud Run/SQL/GCS/Secret Manager/IAM/Logging) | us-central1 (Iowa); us-east1 disaster-recovery replica; GCS US multi-region | Yes — under DPA |
| Google Gemini API | Primary LLM for tools for educators — lesson plans/quizzes/individualization/TTS; on the student portal, since 2026-10-07, only image generation (the character a student designs as an avatar and its poses, from the name and description the student writes; pictures in the online-safety practice chat) until the Azure image quota is raised — every other student-portal AI request goes to Microsoft Azure (rows 4 and 22-24) | Global — Google may store transiently or cache prompts and responses in any country where Google or its agents maintain facilities (Gemini API Additional Terms, paid services), and logs them for a limited period to detect abuse | Yes — under DPA |
| OpenAI | Tools for educators only; since 2026-10-07 it receives nothing from the student portal (Microsoft Azure AI Content Safety and Azure OpenAI serve it, rows 23-24). Augmenting safety screening (OpenAI Moderation API, when enabled) of text teachers save (including accommodation notes), AI-generated text in tools for educators, and the characters and scenes students made when a teacher builds a class story from them: harmful-content moderation (falling back to a small internal deterministic keyword list when the OpenAI layer is unavailable) plus a self-harm/crisis signal that augments RevolutionEd's always-on crisis-lexicon classifier; the active generator's own built-in safety filter (Google Gemini by default) screens generated output, including OpenAI's own output when OpenAI is the active generator — and, on a self-harm indication in a teacher's report of concern, sends a minimized alert to the school safety contact (not parents/police by default; based on the safety concern, not identity); also a fallback and administrator-selectable text-generation provider — an instructional AI request may be served by OpenAI when the primary generator (Google Gemini) is briefly unavailable, or when an admin selects OpenAI as primary; nothing sent to OpenAI is used for training; OpenAI keeps no copy of text sent for screening, and may keep generation prompts in its abuse-monitoring logs for up to 30 days (Zero Data Retention is not enabled); search-grounded queries and inline images and audio are kept on Google Gemini and are not sent to OpenAI | Global — OpenAI's data processing addendum sets no United States-only processing limit | Yes — under DPA |
| Microsoft Azure AI Speech | Pronunciation scoring of a student's recorded reading, sent with the passage text (transient child voice; the only service that receives the recording; no recognition/voiceprint; no scores or transcripts kept); and, since 2026-10-07, reading text aloud to students (real-time text to speech: reading-practice passages and definitions, practice sentences, pronunciation tips, character voice samples) — text only, which Microsoft does not store | eastus (USA) | Yes — under DPA |
| ElevenLabs | TTS — DECOMMISSIONED (integration removed 2026-07-13: shim + SDK + dead code deleted; Gemini is the TTS path); text only, no child voice | USA | No PII |
| Stripe, Inc. | Administrative customer-record deletion (admin Customer.delete); no card capture / no payment surface | Global — Stripe processes data in the United States and other countries (no student data) | Yes — under DPA |
| SendGrid (Twilio, Inc.) | Transactional email + event webhook | Global — Twilio's hosting providers are in the United States (Security Overview 8.2), but its sub-processor list gives United States and European Union locations for SendGrid email routing and hosting; SendGrid has no United States-only option | Yes — under DPA |
| Clever, Inc. | Single sign-on and roster source for districts that use Clever. Clever is the district's own provider: it supplies student and teacher identifiers, email addresses, names, grades and sections to RevolutionEd at the district's direction, and receives no student records from RevolutionEd | USA | No PII |
| ClassLink, Inc. | Single sign-on and OneRoster roster source for districts that use ClassLink. ClassLink is the district's own provider: it supplies student and teacher identifiers, email addresses, names, grades, sections and enrollments to RevolutionEd at the district's direction, and receives no student records from RevolutionEd | USA | No PII |
| Google OAuth 2.0 / OIDC | Teacher/admin SSO | Global — Google's sign-in infrastructure (educator identity only) | Yes — under DPA |
| Google Classroom API | Optional teacher-initiated roster import | Global — rosters are read from the school's own Google Workspace, whose storage location follows the school's agreement with Google | Yes — under DPA |
| Google Drive / Docs / Slides APIs | Optional teacher-initiated export of a lesson plan, quiz or curriculum-tool result as a Google Doc to Google Drive (drive.file scope; the Slides API is no longer used). Since 2026-10-05 only into a Google Workspace account (a school's or another organization's), checked with Google at each export, and not from a RevolutionEd staff account. The lesson-plan page and the tool pages offering a folder choice load Google's file picker in the educator's browser. The document carries its content and usually the teacher's name and school; a document made for one student (an individualized lesson plan or a quiz built from it, or a curriculum-tool result for a selected student) can also carry that student's name and content written from the teacher's notes about the student, which can repeat those notes and reveal a disability, a health or behavioral need, or an IEP or 504 plan. Separately, one curriculum browser (Minneapolis) shows Office files in Google's Docs viewer (docs.google.com/gview): the educator's browser loads it and Google receives the browser's IP address and device details and a five-minute link to the curriculum file, which holds no student information | Global — exports go to the teacher's Google Workspace Drive, whose storage location follows that organization's agreement with Google | Yes — under DPA |
| Unsplash | Stock imagery — DECOMMISSIONED 2026-10-01 (an image-search module added in April 2026 was never called by any feature and has been deleted; no live calls; decommissioned record retained) | Global — never called by our service, so no data was sent | No PII |
| Serper.dev | Web image-search proxy (query strings only) | Global — Serper says it operates globally and publishes no hosting location (search query strings only) | No PII |
| JASON Learning | Curriculum lookup (query strings only) | USA | No PII |
| Texas Instruments | TI resource lookup (query strings + downloads) | USA | No PII |
| U.S. Dept. of Education — College Scorecard | Public college data — DECOMMISSIONED (integration removed 2026-07-14 with Experience Details / college profile field; /search_colleges + COLLEGE_API_KEY deleted; no live calls) | USA (Federal) | No PII |
| Library of Congress | Primary-source search (no PII) | USA (Federal) | No PII |
| randomuser.me | Synthetic profile generation (no outbound data) | USA | No PII |
| Microsoft Office Online viewer | Renders a curriculum lesson deck in the document viewer that signed-in educators use; not reachable from the student experience. Our server signs a link to the deck that expires in five minutes, Microsoft fetches the deck from that link, and the educator's browser loads the rendered view from Microsoft, which receives the browser's IP address and device details; while it runs, the viewer also checks whether that browser is signed in to a Microsoft account (so Microsoft can link the session to it), sends Microsoft usage and diagnostic data and, where the browser allows, sets Microsoft cookies that identify the browser; no student records are sent | Global — Microsoft Office Online service (curriculum files and the viewer's IP address; no student records) | No PII |
| Have I Been Pwned (Pwned Passwords range API) | Breached-password screening on password set/reset (k-anonymized SHA-1 5-char prefix; Cloudflare-fronted; fail-open — availability is not a data-path dependency) | Global — Cloudflare edge network (k-anonymized hash prefix only) | No PII |
| Microsoft Azure AI Translator | Optional translation into a chosen non-English language: interface text (fixed literals); partner curriculum where a teacher set the lesson to another language, translated when the lesson is prepared and when a student opens it; and, behind its own gate, AI-generated replies and story text addressed to a student — the only path carrying student data, enabled 2026-09-21 (AI-generated content for New York students stays in English; Microsoft does not store or train on submitted text) | USA (Microsoft Americas endpoint: East US 2 / West US 2); resource region eastus | Yes — under DPA |
| Microsoft Azure OpenAI | AI for the student portal since 2026-10-07: the tutor chat, feedback on writing and reflections, practice questions and quiz grading, the online-safety practice chat, reading a picture a student uploads, citations, reading-level estimates, personalized lessons, pronunciation tips (written from the passage and up to three words, never the recording) and choosing a voice for a character a student designs; also the follow-up checks in safety screening. Receives what students type and the context those features need, which can include a first name, class, teacher, school, grade, reading level, scores and an uploaded picture, and for the follow-up checks text Content Safety flags; no voice recordings (no training; not available to OpenAI) | USA (Data Zone Standard, United States data zone; abuse-monitoring storage in the US geography); resource region eastus2 | Yes — under DPA |
| Microsoft Azure AI Content Safety | Safety screening on the student portal since 2026-10-07: text students write, the AI's replies in chats and citations, pronunciation transcripts and tips, text read aloud to students, and report-a-concern text, except in the tutor chat (where our own crisis check and Azure OpenAI's built-in content filter apply), scored for hate, sexual content, violence and self-harm, feeding the crisis-support and child-safety routing (text only, identifiers removed; Microsoft does not store it, train on it or make it available for human review) | eastus2 (USA) | Yes — under DPA |
Browser-side (loaded directly by the user's browser, which sends each the device's IP address and request details; no account or student records from us; listed for transparency)
| Sub-processor | Function | Residency | Receives personal information? |
|---|---|---|---|
| Google Tag Manager | REMOVED from this service (deployed 2026-07-10). From 2026-02-25 this service's two main page layouts loaded the Google Tag Manager container on every page, which fired advertising tags configured in Google's console as well as Google Analytics. This service loads no tag manager. The container itself still exists and is used on our marketing website (revolutioned.ai), which is not part of this service | USA | No PII |
| Google Analytics | Analytics — DECOMMISSIONED on this service 2026-10-05. It ran here through the tag manager (B22) until 2026-07-10; the direct gtag.js loader that replaced it had no measurement ID in production, so it loaded nothing, and it has been deleted. Google Analytics is still used on our marketing website (revolutioned.ai), which is not part of this service | Global — Google (no longer loaded by this service) | No PII |
| CallRail | Call attribution — REMOVED from this service on 2026-10-05. Until then the visitor's browser loaded CallRail's script on pages of this service (without a consent step until July 10, 2026; from mid-September 2026 only on public pages, after marketing consent), and CallRail received the IP address, browser and device details, the pages visited, the referring address, any campaign or advertising click identifier carried in the link and any Google Analytics cookie identifier, and set an attribution cookie. CallRail is still used on our marketing website (revolutioned.ai), which is not part of this service | USA | No PII |
| YouTube embed | Videos in curriculum lessons, including lessons assigned to students, played in YouTube's privacy-enhanced mode (youtube-nocookie.com) with no autoplay. The viewer's browser loads the player from Google, which receives the viewer's IP address and browser and device details; no account or student records are sent | Global — Google (YouTube) | No PII |
| Imgur | Static logo asset (no data outbound) | USA | No PII |
| Google Fonts | Font CDN (request metadata) | Global — Google edge network | No PII |
| jsDelivr CDN | JS/CSS library CDN (SRI-pinned) | Global — jsDelivr content-delivery network | No PII |
| Cloudflare cdnjs | Icon-library and stylesheet CDN: Font Awesome (stylesheet and icon fonts) and the Spectrum color-picker stylesheet, each integrity-pinned; no scripts (request metadata) | Global — Cloudflare content-delivery network | No PII |
| MathJax CDN | LaTeX rendering (request metadata) | Global — content-delivery network | No PII |
| Plotly CDN | Chart rendering — admin pages (request metadata) | Global — content-delivery network | No PII |
| Brandfolder embed | Bluebonnet preview (embed token only) | USA | No PII |
Offline data-pipeline (not in production runtime; no PII)
| Sub-processor | Function | Residency | Receives personal information? |
|---|---|---|---|
| Brandfolder API | TEA Bluebonnet PPTX acquisition (offline) | USA | No PII |
| TEA Canvas LMS | TEA Bluebonnet course scrape (offline) | USA | No PII |
| BC Government curriculum | BC provincial standards (offline) | USA/Canada (public) | No PII |
| Minnesota Dept. of Education / MN Library Assoc. | MN state standards (offline) | USA (public) | No PII |
| WIDA | ELL standards (offline) | USA (public) | No PII |
Notice of new sub-processors & your right to object
Before a new or replacement sub-processor begins processing student data, RevolutionEd gives the educational agency at least 30 days' advance notice (to the data-protection contact on file, plus an in-product notice and an update to this page). Within that window you may object on reasonable data-protection grounds (GDPR Art. 28(2); 8 NYCRR § 121.3; NDPA; your DPA § 6.3). If you object and we cannot offer a commercially reasonable alternative or work-around, you may terminate the affected service without penalty and we will return or destroy the affected data.
Object to a sub-processor
You can also object at any time by emailing our Privacy Officer, Arsenios Scrivens (Chief Privacy & Compliance Officer), at registration@revolutioned.ai.
See also our Privacy Policy and Parents' Bill of Rights. The summary above lists who each sub-processor is; the full contractual detail for every PII-receiving sub-processor — contract type, DPA status, no-sale and no-AI-training commitments, breach-notice timeline, residency, and downstream (fourth-party) posture — is set out in Exhibit A, the sub-processor exhibit to our Data Privacy Agreement (the same source that generates this page). Current and prospective customers can request the full Exhibit A from our Privacy Officer at registration@revolutioned.ai.