Subprocessors · PULSE by The Inclusive Practice, LLC

Active Subprocessors

Currently in use

These subprocessors receive Platform data because PULSE sends it to them, acting on our instruction, in the delivery of the platform.

Subprocessor	Purpose	Data Processed	Location	Status
Supabase, Inc. SOC 2 Type II · ISO 27001	Database hosting, authentication, and file storage Primary data store for all Platform data	All Platform Data	United States (AWS)	Active
Amazon Web Services, Inc. SOC 2 Type II · ISO 27001	Secure file transfer (SFTP) and encrypted object storage Receives scheduled district data feeds; per-district access isolation enforced at the file layer	Student and staff data in scheduled district exports	United States	Active
Vercel, Inc.	Application hosting, content delivery, and performance measurement Serves the PULSE web application; every request transits it. Page-view and page-speed telemetry is collected for pages a signed-in user opens.	Request metadata; page-view and performance measurements	United States	Active
Anthropic, PBC	AI language model services Document extraction (budget documents, collective bargaining agreements, bell schedules); budget narrative generation; workload, staffing and organizational-health narratives; scheduling compliance review; and classification of a district's own service vocabulary	Uploaded documents in full; organizational, workload, staffing and budget data	United States	Active
Resend, Inc.	Transactional email delivery Invitation emails, mention notifications, shared reports, and quote and audit requests	Email addresses, names	United States	Active
Functional Software, Inc. (Sentry)	Application error monitoring and session replay Captures application errors and a sample of user sessions to diagnose faults. Session text, form inputs and media are masked before transmission; page addresses and error messages are not masked.	Error diagnostics and masked session replay	United States	Active
beehiiv, Inc.	Newsletter subscription management Delivers the From the Field newsletter. A district employee reaches beehiiv only by ticking an unticked opt-in box — on the invitation acceptance form, or on a public form on our marketing site. Declining, or ignoring it, sends nothing and never affects standing in PULSE.	Email address and job role, for those who opt in	United States	Active
Google LLC	Google Sign-In (OAuth 2.0 authentication) Optional sign-in method. Where a district uses it, Google returns the name and email on the account.	Name and email address at sign-in. No student data is transferred to Google.	United States	Active
Google LLC (Calendar)	Optional calendar connection for a staff member's own calendar NO DISTRICT HAS CONNECTED A CALENDAR AND NOTHING IS SENT TODAY. It is named here ahead of the first connection rather than after it. A staff member may connect her own Google Calendar so its entries appear beside her PULSE week. She authorises it herself and can disconnect it at any time. PULSE reads the calendar and never writes to it, and no entry from it is stored. No student record, and no data belonging to the district, is sent to Google by this feature.	The staff member's own calendar entries, read and displayed and not retained. Nothing is sent to Google except the authorisation she granted.	United States	Active
Microsoft Corporation	Optional calendar connection for a staff member's own Outlook calendar NO DISTRICT HAS CONNECTED A CALENDAR AND NOTHING IS SENT TODAY. It is named here ahead of the first connection rather than after it. The same optional connection as the Google row above, for a district using Outlook. A staff member authorises it herself and can disconnect it at any time. PULSE reads the calendar and never writes to it, and no entry from it is stored. No student record, and no data belonging to the district, is sent to Microsoft by this feature.	The staff member's own calendar entries, read and displayed and not retained. Nothing is sent to Microsoft except the authorisation she granted.	United States	Active

Third-Party Content and Security Services

Contacted by the browser, not by us

These services are contacted directly by a visitor’s browser when it loads embedded content or completes a security challenge. They observe the request — an address, a referring page — and receive no Platform data from us. They are listed for completeness; whether each is a subprocessor under your agreement is a question for the agreement.

Subprocessor	Purpose	Data Processed	Location	Status
Cloudflare, Inc. SOC 2 Type II · ISO 27001	Automated-abuse prevention (Turnstile) Runs a challenge in the visitor's browser on public forms and on the request-an-audit form, then verifies the resulting token from our servers. Cloudflare observes the visitor's address and browser characteristics; we send it the token only.	Visitor IP address and browser signals; a challenge token	United States	Active
Internet Archive (Open Library)	Book cover images in the professional library Thirteen titles in the shared professional library carry cover art hosted by Open Library. A reader's browser fetches those images directly, so Open Library observes the request. No district, staff or student data is sent.	Viewer IP address and referring page	United States	Active
Google LLC (YouTube)	Embedded lesson video Where a district attaches a YouTube video to a professional-learning lesson, the viewer's browser loads it from YouTube. Nothing is sent by us.	Viewer IP address and referring page	United States	Active
Vimeo, Inc.	Embedded lesson video The same lesson-video path accepts Vimeo addresses. No lesson uses one today; the path is live and one paste away, so it is listed rather than left for a district to discover.	Viewer IP address and referring page	United States	Active

Anticipated Subprocessors

Integrations in active development

These subprocessors are planned for integration within the next 12 months.
Customers will be notified before any of these integrations are activated.

Subprocessor	Purpose	Data Processed	Location	Status
Clever, Inc.	Student information system rostering and SSO Automated roster sync and single sign-on for school districts	Student roster data	United States	Pending
ClassLink, Inc.	Identity and rostering integration SSO and roster management for district deployments	Identity and roster data	United States	Pending
Edlink, Inc.	Student information system rostering integration Unified roster and staff sync across SIS platforms. The client is written and no code calls it; no district is connected.	Student and staff roster data	United States	Pending

Change Log

Updates to this list

A record of all changes to our subprocessor list.

September 9, 2026 Added beehiiv, Inc. beehiiv delivers the From the Field newsletter and receives an email address and a job role for each person who opts in. A district employee reaches it only by ticking an unticked box on the invitation acceptance form or on a public form; the tick has never been on by default, and declining sends nothing. beehiiv has received addresses this way since the invitation flow shipped and was omitted from earlier versions of this list.

September 9, 2026 Added Cloudflare, Inc. (Turnstile), Internet Archive (Open Library), Google LLC (YouTube) and Vimeo, Inc. under a new heading, Third-Party Content and Security Services. Each is contacted directly by a visitor’s browser when it loads embedded content or completes a security challenge; each observes the request and receives no Platform data from us. They were absent from earlier versions of this list.

September 9, 2026 Broadened the description of Vercel, Inc. to name page-view and page-speed measurement. The prior description said hosting and content delivery only, and the data processed as request metadata only.

September 9, 2026 This list is now GENERATED from the application’s own source (lib/legal/subprocessors.json), and the Privacy Policy’s data-sharing section is generated from the same file. An automated check fails the build when the two disagree, or when the application gains an outbound recipient that appears in neither.

September 1, 2026 Added Functional Software, Inc. (Sentry) for application error monitoring and session replay. Sentry has received error diagnostics since the platform launched and was omitted from earlier versions of this list; it is added here on review. Session text, form inputs and media are masked before transmission.

September 1, 2026 Broadened the description of Anthropic, PBC to state every Platform feature that uses language model services, including document extraction and budget narrative generation. The prior description named only scheduling optimization and workload analysis, and described the data as anonymized; uploaded documents are transmitted in full and are not anonymized.

September 1, 2026 Removed Stripe, Inc. Payment processing has been retired from the Platform and no data is transferred to Stripe.

August 2, 2026 Removed DocuSeal, LLC. Electronic document execution has been retired; no district data is transferred to DocuSeal. Executed agreements signed before this date remain on file.

July 23, 2026 Added Amazon Web Services (active) for secure district data feed transfer and storage. Added Edlink (anticipated) for student information system rostering.

May 22, 2026 Initial subprocessor list published. Active: Supabase, Vercel, Resend, Stripe, Anthropic, Google Sign-In, DocuSeal. Anticipated: Clever, ClassLink.