# Outleap Data-Flow Description

Status: Current service flow as at 26 September 2026. This document should be
read with the DPA, DPIA starter, retention schedule and subprocessor list.

## 1. Account and application data

1. A student or staff member connects to the Outleap web application over TLS.
2. Firebase Authentication verifies the account.
3. Firebase Hosting proxies `/api/**` to the Outleap API in Google Cloud
   `europe-west2` (London).
4. The API applies role and school scoping before reading or writing Firestore.
5. Core account, statement, evidence, feedback and workflow records remain in
   the configured Google Cloud/Firebase environment.

## 2. AI-assisted workflows

1. Within an authorised workflow, a student asks for AI-assisted feedback on
   their own writing, or for drafting support (a first CV built from their own
   evidence, or a reworded CV point), or has a note about something they have
   done sorted into a piece of evidence. Where enabled, Outleap also reads a
   course page the student keeps, or an advert or link they paste, to find
   what it asks for.
2. The API sends the relevant student-provided content, or the course page or
   advert being read, and the minimum workflow context needed to provide that
   support to an approved AI service provider over encrypted transport.
3. Current AI service providers are listed in the subprocessor list. Processing
   is configured for UK/EU regions.
4. The provider returns a response to the API, which validates it before use.
5. The API stores the resulting feedback, the CV the student asked for, or a
   course page's reading, with bounded operational metadata in Firestore.
   Feedback on a cover letter or an application answer can include suggested
   wording, which is stored with the feedback and not shown in the product
   views. A reworded CV point, a sorted piece of evidence and an advert's
   reading are returned to the student and stored only if the student chooses
   to keep them. Stored records are visible only through the normal authorised
   product views.

Outleap does not send passwords, authentication tokens or unrelated student
records to AI providers. Application logs must not contain student content,
prompts or AI outputs.

## 3. Other flows

- Transactional email sends the recipient address and necessary message
  content to Postmark.
- Data-subject requests, deletion and export are actioned by Outleap on the
  school's documented instructions, subject to agreed retention and legal
  obligations.