LEGAL / SUBPROCESSORS

Two subprocessors. Both named. Both contractually bound.

A subprocessor is any third party that processes student data on our behalf. Most education software platforms have a long list. We have exactly two, and we mean to keep it that way.

Current subprocessors

Amazon Web Services, Inc. Subprocessor 01
Name
Amazon Web Services, Inc.
Role
Cloud hosting, encryption (KMS), AI inference (AWS Bedrock), storage (S3, RDS), monitoring, logging.
Region
United States (us-east-1, us-west-2)
Data categories
All categories at rest. Schema + queries + intermediate results in transit to Bedrock for SQL generation and summarisation. Zero data retention by Bedrock.
Compliance
SOC 1/2/3 Type II · ISO 27001 · FedRAMP Moderate · HIPAA-eligible · explicit FERPA support
DPA status
AWS Data Processing Addendum and BAA executed; renewable annually.
Ednition, Inc. (RosterStream) Subprocessor 02
Name
Ednition, Inc. (RosterStream)
Role
SIS data integration pipeline. Pulls roster, attendance, assessment, and IEP records from the district’s SIS and delivers them to Upstart’s warehouse.
Region
United States
Data categories
In transit only, Ednition does not retain student data beyond pipeline transit.
Compliance
SOC 2 Type II attestation on file.
DPA status
Subprocessor SOW with Upstart with matching FERPA/DPA flow-downs to every district. Annual review.

What we deliberately do not use

  • ✕No OpenAI, no Google AI, no Anthropic direct API. All AI processing goes through AWS Bedrock.
  • ✕No analytics SDKs that touch student data.
  • ✕No advertising or tracking networks.
  • ✕No third-party usage-pixel or telemetry vendors.

How we change subprocessors

We give districts at least 5 business days’ advance written notice before adding any new subprocessor that handles student data. Districts may object during that window. If a district objects, we either remove the subprocessor or exit the district contract, we do not override the objection.

Last reviewed: 28 May 2026