This document is provided for informational purposes during our pre-launch period. A comprehensive, attorney-reviewed version will be published prior to the platform processing student data.
TRANSPARENCY
Subprocessor List
Every third-party service provider used to deliver SPEDScribe.
Last reviewed: April 2026
SPEDScribe.ai uses the following third-party service providers (subprocessors) to deliver our platform. Every subprocessor named below is contracted under a Data Processing Agreement. Anthropic does not use API inputs for model training under their commercial terms; SPEDScribe does not hold a Zero Data Retention enterprise agreement. AssemblyAI processes audio under contract terms governing retention.
| VENDOR | CATEGORY | PURPOSE | DATA PROCESSED | LOCATION |
|---|---|---|---|---|
| Anthropic | Clinical Intelligence Engine | AI-powered documentation generation (Claude API) under Anthropic's commercial terms; no training on customer data; SPEDScribe does not hold a Zero Data Retention enterprise agreement | Server-side PII-redacted session transcripts (designed to strip identifiers; not a guarantee of full removal). Anthropic retains inputs and outputs briefly for abuse detection and to meet legal obligations before deletion under their commercial terms. | United States |
| AssemblyAI | Speech Recognition | Audio transcription; built-in PII redaction applied to the returned transcript | Session audio recordings; AssemblyAI applies built-in PII redaction during transcription. Subprocessor retention behavior follows their published policies and our contract terms. | United States |
| Supabase | Database Infrastructure | Encrypted storage of session data and documentation | Account data, server-side PII-redacted transcripts, generated documentation | United States (US West region) |
| Vercel | Hosting & Deployment | Web application hosting and content delivery | Application code, static assets, request logs (no student data) | United States |
| Clerk | Authentication | User identity verification and SSO | User credentials, session tokens, profile metadata | United States |
| Sentry | Error Monitoring | Production error tracking and stack-trace collection. Session replays disabled per FERPA. | Error metadata with PII scrubbed before send (no email, cookies, request bodies, or query strings). No user-identifying data sent. All Sentry events are stripped of user context before send. | United States |
| Plausible Analytics | Privacy-First Analytics | Cookieless aggregate pageview and event tracking. No personal data collected. GDPR-friendly by design. | Aggregate pageviews, outbound link clicks, custom event names with no personal data props. | European Union |
Note on GoHighLevel: GoHighLevel is NOT listed as a subprocessor because it does not process student data. It is used exclusively for demo booking and sales-contact forms and receives only business contact information (name, email, district name) from prospective customers.
Change Notification
We provide 30 days advance written notice before adding new subprocessors or materially changing the role of existing subprocessors. Notice is provided via email to the designated district privacy contact.
To subscribe to subprocessor change notifications, contact: compliance@spedscribe.ai
Questions
For questions about our subprocessors or data processing practices, contact privacy@spedscribe.ai.