Sub-processors
Every third party that processes school or student data on our behalf, what each one does, and where it processes. We version this page and give schools 30 days' notice of a change.
Which third parties process school data?
Ten, each for a specific purpose: Google for the AI marking itself, Supabase for database and file storage, Trigger.dev for background jobs, Resend for transactional email including student feedback, PostHog for product analytics, Loops for teacher lifecycle email, Slack for internal failure alerts, Vercel for hosting, HubSpot for CRM and support chat, and Lemon Squeezy for payments as merchant of record. Only Google receives student work itself; each party is engaged under a written data protection agreement, and we remain fully liable to our customers for all of them.
The list
Every party that processes school or student data on our behalf, with its role and processing region. US parties are on EU Standard Contractual Clauses and the UK Addendum; EU parties process within the EEA.
| Sub-processor | What they do | Region | Transfer mechanism |
|---|---|---|---|
| Google (Gemini API) | AI marking - transcribes answers and proposes marks, feedback and summaries | United States and global infrastructure | EU SCCs and UK Addendum |
| Supabase | Database, authentication and file storage | Germany (Frankfurt) | Stored within the EEA; SCCs for US administrative access |
| Trigger.dev | Background jobs - marking, extraction, exports and notifications | United States | EU SCCs and UK Addendum |
| Resend | Transactional email, including student feedback | United States | EU SCCs and UK Addendum |
| PostHog | Product analytics and session recording | European Union | Processing within the EEA |
| Loops | Product and lifecycle email to teachers | United States | EU SCCs and UK Addendum |
| Slack | Internal operational alerting | United States | EU SCCs and UK Addendum |
| Vercel | Application hosting | United States | EU SCCs and UK Addendum |
| HubSpot | CRM, website analytics and support chat | European Union | Processing within the EEA |
| Lemon Squeezy | Payment processing, as merchant of record | United States | EU SCCs and UK Addendum |
Only one receives student work
Of the ten, only Google's Gemini API receives student work itself, because that is what performs the marking. Several others can receive student names, marks or email addresses through storage, background jobs, email, or operational alerts; Vercel, HubSpot and Lemon Squeezy process no student data at all. The table's transfer column shows the safeguard for each.
Notice of changes
We give schools at least 30 days' notice before we add or replace a sub-processor. A school may object on reasonable data protection grounds within that period; if we cannot resolve the objection, the school may terminate and we refund the unused portion of the fee. To receive change notices, email privacy@marking.ai and ask to be added to the list.
What we are changing
We list these because they affect the table above: we are removing student names from internal alerting and lifecycle email so that Slack and Loops no longer receive them, removing recipient email addresses from application logs, removing third-party scripts from the student upload and results pages, masking student content in session recordings, and migrating AI inference to a European region.
Assessment terms explained
Plain-English definitions of the vocabulary used on this page.
- AI markingAI marking is the use of artificial intelligence to assess student work against defined criteria - a mark scheme or a teacher's own marking guidelines - and to draft marks and feedback for a teacher to review.
- Assessment for learningAssessment for learning is the practice of using evidence of what students currently understand to decide what to teach next, and to help students see what they need to do to improve.
- Assessment objectivesAssessment objectives are the categories of skill a qualification tests - commonly labelled AO1, AO2 and AO3 - each carrying a defined share of the available marks.
- Comparative judgementComparative judgement is an assessment method in which markers repeatedly choose the better of two pieces of work, and those paired decisions are combined statistically into a rank order.
- Criterion-referenced assessmentCriterion-referenced assessment judges work against defined standards of what a student should know or be able to do, rather than against how other students performed.
- ExemplarAn exemplar is a piece of work - often a real student answer - presented with its marks and commentary to show what a particular standard looks like in practice.
The evidence your DPO will ask for
Ask us for the pack - our DPIA, our data processing agreement and the security overview - and a person will send it. If you would rather be walked through it first, book a demo for your school.
