Subprocessors

Primary data store for all Platform data

Receives scheduled district data feeds; per-district access isolation enforced at the file layer

Serves the PULSE web application; every request transits it. Web Analytics counts page views on public pages only, never on signed-in pages. Speed Insights records page-load timings, not page views, on pages in the product.

Document extraction (budget documents, collective bargaining agreements, bell schedules); budget narrative generation; workload, staffing and organizational-health narratives; scheduling compliance review; and classification of a district's own service vocabulary

Invitation emails, mention notifications, shared reports, and quote and audit requests

Hosts the course videos PULSE staff record, writes their draft captions, and streams them to learners. A video plays only after a person has checked its captions. Mux's viewing analytics are off. Nothing about students or staff is sent: each video carries only our own video id and its title.

Captures error reports to diagnose faults. Error reports only: session replay is off, so no recording of a user's session is sent. Page addresses and error messages are included in error reports.

Delivers the From the Field newsletter. A district employee reaches beehiiv only by their own choice: by ticking an unticked opt-in box on the invitation acceptance form, or by subscribing on a public form on our marketing site. Declining, or ignoring it, sends nothing and never affects standing in PULSE.

Optional sign-in method. Where a district uses it, Google returns the name and email on the account.

A staff member may connect their own Google Calendar. They authorize it themselves and can disconnect it at any time, which withdraws the permission at Google. Their events are read each time they open their PULSE calendar and shown beside it; their titles, descriptions and guests are not stored. PULSE writes to their calendar only when they create, move, rename, invite people to or delete an event from PULSE, and only events they organize. Service sessions are never sent to Google, and a meeting title that could name a student is replaced with one that names none unless their account is on a domain their district has declared. If they tell PULSE what an event was, PULSE stores their answer with the event's date and time (not its title). If they import sessions from their calendar, the sessions' titles are kept for up to 7 days while they review them; what they confirm becomes their schedule and the rest is deleted. Administrators see only weekly totals of classified time. No student record is sent to Google by this feature.

A staff member may connect their own Google Drive to share a file into a PULSE team or conversation. PULSE accesses only the files they pick, one at a time, in Google's own file chooser (drive.file); it cannot browse, list or search their Drive. For each file they share, PULSE stores its name, type, owner and link so their team can open it; the file stays in Google Drive and Google's sharing decides who can open it. At their request PULSE can give the people in that conversation view access to that file, and remove that access again. If they choose Save to Google Slides on a report, PULSE creates that one presentation in their Drive from the report's de-identified figures; a deck that includes student information can only be downloaded and is never saved to Google. A staff member may also open an AAC evaluation they wrote in Google Docs; this sends that one evaluation to their own Drive, and it happens only when their Google account is on an email domain their district has declared as its own, so it goes only into the district's own Google Workspace and never into a personal Google account. They can disconnect at any time. A student record goes to Google only this way, into the district's own Google Workspace.

NO DISTRICT HAS CONNECTED A CALENDAR AND NOTHING IS SENT TODAY. It is named here ahead of the first connection rather than after it. The same optional connection as the Google row above, for a district using Outlook. A staff member authorizes it themselves and can disconnect it at any time. PULSE reads the calendar and never writes to it, and no entry from it is stored. No student record, and no data belonging to the district, is sent to Microsoft by this feature.

Runs a challenge in the visitor's browser on public forms and on the request-an-audit form, then verifies the resulting token from our servers. Cloudflare observes the visitor's address and browser characteristics; we send it the token only.

Thirteen titles in the shared professional library carry cover art hosted by Open Library. A reader's browser fetches those images directly, so Open Library observes the request. No district, staff or student data is sent.

Where a district attaches a YouTube video to a professional-learning lesson, the viewer's browser loads it from YouTube. Nothing is sent by us.

The same lesson-video path accepts Vimeo addresses. No lesson uses one today; the path is live and one paste away, so it is listed rather than left for a district to discover.

Where a course lesson links a video stored in Google Drive, the AAC course portal shows Drive's own preview of that file in a frame, so the viewer's browser loads it from Google Drive. Nothing is sent by us. This is separate from the optional Drive connection above, which a staff member turns on themselves.

The transportation map draws a street map under the runs when PULSE has a street-map key configured. A viewer's browser asks MapTiler for the map style, map tiles, fonts and icons, so MapTiler observes the map area on screen and the viewer's IP address. Every pickup, school, run and name is drawn in the browser from the page's own data and is never sent. Without a key the map uses public Census outlines served by PULSE and contacts no one.

Automated roster sync and single sign-on for school districts

SSO and roster management for district deployments

Unified roster and staff sync across SIS platforms. The client is written and no code calls it; no district is connected.

Relays a notification to Apple or Google for delivery to a phone. Connected to the notification dispatcher but disabled by a code switch; sends nothing until enabled and noticed to districts. What it would receive is a device push token, a title and a one-line body naming the colleague and the kind of event, and a link carrying opaque identifiers. No student information.