Outleap Data-Flow Description

Status: Current launch-product flow as at 25 July 2026. This document should be read with the DPA, DPIA starter, retention schedule and subprocessor list.

1. Account and application data

1. A student or staff member connects to the Outleap web application over TLS.
2. Firebase Authentication verifies the account.
3. Firebase Hosting proxies /api/** to the Outleap API in Google Cloud europe-west2 (London).
4. The API applies role and school scoping before reading or writing Firestore.
5. Core account, statement, evidence, feedback and workflow records remain in the configured Google Cloud/Firebase environment.

2. AI-assisted workflows

1. A student requests AI-assisted feedback or drafting support within an authorised workflow.
2. The API sends the relevant student-provided content and the minimum workflow context needed to provide that support to an approved AI service provider over encrypted transport.
3. Current AI service providers are listed in the subprocessor list. Processing is configured for UK/EU regions.
4. The provider returns a response to the API, which validates it before use.
5. The API stores the resulting feedback or draft and bounded operational metadata in Firestore. It is visible only through the normal authorised product views.

Outleap does not send passwords, authentication tokens or unrelated student records to AI providers. Application logs must not contain student content, prompts or AI outputs.

3. Other flows

• Transactional email sends the recipient address and necessary message content to Postmark.
• Data-subject requests, deletion and export are actioned by Outleap on the school's documented instructions, subject to agreed retention and legal obligations.