Subprocessor List
Current service-delivery subprocessors, purposes, data categories, and processing locations.
Outleap Subprocessor List
Status: Current service-delivery subprocessors as at 25 July 2026. The signed school agreement and Data Processing Agreement govern the service.
| Subprocessor | Purpose | Data involved | Processing location and transfer notes |
|---|---|---|---|
| Google Cloud / Firebase (Google) | Platform hosting, API runtime, authentication, database, task queue and storage | Account data, student workflow content, feedback records and operational metadata | Core workloads use UK/EU-oriented Google Cloud regions, including europe-west2 and europe-west4 |
| Google Vertex AI | AI-assisted feedback and drafting support where enabled | Relevant student-provided content and the minimum workflow context needed to provide the requested support | UK/EU Google Cloud regions |
| Amazon Web Services (Amazon Bedrock) | AI-assisted feedback and drafting support where enabled | Relevant student-provided content and the minimum workflow context needed to provide the requested support | Supported EU AWS regions |
| Postmark | Transactional login, reminder and notification email | Recipient email address, message metadata and delivery events | US-based processing; the signed contract schedule records the applicable UK transfer safeguard |
Outleap applies data minimisation, encrypted transport, role-scoped access and least-privilege service identities. Outleap does not log student content or AI output.
Material changes to this list should be communicated according to the notice period in the signed school agreement.