1. What this page is
A sub-processor is a third party we engage that processes personal data on an institution’s behalf. The Digital Personal Data Protection Act, 2023 and our own terms require us to tell you who they are.
This list is deliberately honest about status. Learner Lead is in active development ahead of its first institutional release, and several integrations below are built but not yet carrying data. Publishing a flat list that implies otherwise would be the easy option and the wrong one. Each entry says exactly where it stands.
| Status | What it means |
|---|---|
| Live | Currently processing data in production |
| Ready | Integration built and tested, not yet carrying production data |
| Planned | Contracted or selected for a named module that has not shipped |
2. Infrastructure
| Sub-processor | Purpose | Region | Status |
|---|---|---|---|
| Amazon Web Services | Application hosting, PostgreSQL database, Redis cache, object storage, secrets management, load balancing | India (ap-south-1, Mumbai) | Live |
| Amazon CloudFront | Content delivery for public marketing assets only. No institution data passes through it. | Global edge network | Live |
All institution data at rest and in processing stays in the Mumbai region. This is a deliberate choice for the strongest data-residency posture under the DPDP Act, not a default.
3. Communication
| Sub-processor | Purpose | Receives | Region | Status |
|---|---|---|---|---|
| Amazon SES | Transactional email: one-time sign-in codes, fee receipts, invoices, dunning notices, announcements | Recipient email address and message contents | India (ap-south-1) | Ready |
| MSG91 | Transactional SMS and one-time codes | Recipient mobile number and message contents | India | Planned |
| Firebase Cloud Messaging | Mobile push notifications | Device token and notification contents | Google global infrastructure | Planned |
SMS is held behind India’s DLT sender registration, which is a telecom process rather than an engineering one. Until it completes, one-time codes are delivered by email and general notifications by push. The messaging layer sits behind a single adapter interface, so replacing a provider changes one file and nothing that sends a message.
4. Payments
| Sub-processor | Purpose | Receives | Region | Status |
|---|---|---|---|---|
| Razorpay | Fee collection from parents, and platform subscription billing | Payer name, contact details, amount, and the payment instrument, which is handled by Razorpay and never reaches our servers | India | Planned |
Where an institution configures its own Razorpay merchant account, payments settle directly into the institution’s bank account and we never hold funds. Card and bank credentials are entered on the gateway’s own pages. We store the transaction reference and outcome, not the instrument.
5. Operations
| Sub-processor | Purpose | Receives | Region | Status |
|---|---|---|---|---|
| Sentry | Application error tracking | Stack traces, request metadata and the identifier of the affected user where an error is tied to a session | United States or European Union, per Sentry’s hosting | Ready |
| Google Maps Platform | Live bus tracking and geofencing for the transport module | Vehicle location, route and stop coordinates | Google global infrastructure | Planned |
| Expo Application Services | Building and distributing the branded mobile app | Build artefacts and app configuration. No institution data. | United States | Planned |
Error tracking is inert unless a reporting key is configured, and it exists to diagnose faults rather than to observe users. Transport tracking follows vehicles, not children: a bus location is tied to a route and a stop.
6. What we require of them
Every sub-processor is engaged under written terms that oblige it to process personal data only on our instructions, to apply appropriate security measures, to restrict access to staff who need it, and to support us in meeting our own obligations. We remain responsible to the institution for what a sub-processor does.
We assess a candidate on where it processes data, what it needs to receive, its security posture, and whether replacing it later would be a contained change. That last point is why every external service in the platform sits behind an adapter interface with exactly one file that knows the vendor’s name.
7. Changes to this list
We will update this page before a new sub-processor begins processing institution data, and notify institution administrators of the addition. An institution with a reasonable, documented objection to a specific sub-processor should write to the privacy address at the foot of this page so we can discuss it before the change takes effect.