# Outleap Subprocessor List

Status: Current service-delivery subprocessors as at 26 September 2026. The signed
school agreement and Data Processing Agreement govern the service.

| Subprocessor | Purpose | Data involved | Processing location and transfer notes |
| --- | --- | --- | --- |
| Google Cloud / Firebase (Google) | Platform hosting, API runtime, authentication, database, task queue and storage | Account data, student workflow content, feedback records and operational metadata | Core workloads use UK/EU-oriented Google Cloud regions, including `europe-west2` and `europe-west4` |
| Google Vertex AI | AI feedback on students' own writing; on a student's request, a first CV built from their own evidence or a reworded CV point; sorting a note into a piece of evidence; and, where enabled, reading a course page, an advert or a link | Relevant student-provided content, or the page or advert being read, and the minimum workflow context needed to provide the requested support | UK/EU Google Cloud regions |
| Amazon Web Services (Amazon Bedrock) | AI feedback on students' UCAS personal statements, where Outleap routes that feedback to it | The statement and the minimum workflow context needed to provide the feedback | Supported EU AWS regions |
| Postmark | Transactional login, reminder and notification email | Recipient email address, message metadata and delivery events | US-based processing; the signed contract schedule records the applicable UK transfer safeguard |

Outleap applies data minimisation, encrypted transport, role-scoped access and
least-privilege service identities. Outleap does not log student content or AI
output.

Material changes to this list should be communicated according to the notice
period in the signed school agreement.