Security

Sub-processors

Every third party that processes school or student data on our behalf, what each one does, and where it processes. We version this page and give schools 30 days' notice of a change.

Which third parties process school data?

Ten, each for a specific purpose: Google for the AI marking itself, Supabase for database and file storage, Trigger.dev for background jobs, Resend for transactional email including student feedback, PostHog for product analytics, Loops for teacher lifecycle email, Slack for internal failure alerts, Vercel for hosting, HubSpot for CRM and support chat, and Lemon Squeezy for payments as merchant of record. Only Google receives student work itself; each party is engaged under a written data protection agreement, and we remain fully liable to our customers for all of them.

The list

Every party that processes school or student data on our behalf, with its role and processing region. US parties are on EU Standard Contractual Clauses and the UK Addendum; EU parties process within the EEA.

Marking.ai sub-processors, their role, processing region and transfer mechanism
Sub-processorWhat they doRegionTransfer mechanism
Google (Gemini API)AI marking - transcribes answers and proposes marks, feedback and summariesUnited States and global infrastructureEU SCCs and UK Addendum
SupabaseDatabase, authentication and file storageGermany (Frankfurt)Stored within the EEA; SCCs for US administrative access
Trigger.devBackground jobs - marking, extraction, exports and notificationsUnited StatesEU SCCs and UK Addendum
ResendTransactional email, including student feedbackUnited StatesEU SCCs and UK Addendum
PostHogProduct analytics and session recordingEuropean UnionProcessing within the EEA
LoopsProduct and lifecycle email to teachersUnited StatesEU SCCs and UK Addendum
SlackInternal operational alertingUnited StatesEU SCCs and UK Addendum
VercelApplication hostingUnited StatesEU SCCs and UK Addendum
HubSpotCRM, website analytics and support chatEuropean UnionProcessing within the EEA
Lemon SqueezyPayment processing, as merchant of recordUnited StatesEU SCCs and UK Addendum

Only one receives student work

Of the ten, only Google's Gemini API receives student work itself, because that is what performs the marking. Several others can receive student names, marks or email addresses through storage, background jobs, email, or operational alerts; Vercel, HubSpot and Lemon Squeezy process no student data at all. The table's transfer column shows the safeguard for each.

Notice of changes

We give schools at least 30 days' notice before we add or replace a sub-processor. A school may object on reasonable data protection grounds within that period; if we cannot resolve the objection, the school may terminate and we refund the unused portion of the fee. To receive change notices, email privacy@marking.ai and ask to be added to the list.

What we are changing

We list these because they affect the table above: we are removing student names from internal alerting and lifecycle email so that Slack and Loops no longer receive them, removing recipient email addresses from application logs, removing third-party scripts from the student upload and results pages, masking student content in session recordings, and migrating AI inference to a European region.

The evidence your DPO will ask for

Ask us for the pack - our DPIA, our data processing agreement and the security overview - and a person will send it. If you would rather be walked through it first, book a demo for your school.