Contents
Railway — Application Hosting & Primary Database
Core API, PostgreSQL, Redis, and Memgraph
Railway hosts the ThinkKits production application and all ancillary services. The primary deployment region is US-West (Oregon). No data is replicated to non-US regions.
| Data Type | Service | Region | Encryption at Rest | Encryption in Transit | Backup |
|---|---|---|---|---|---|
| Application code & runtime | Railway — FastAPI / Uvicorn | US-West (Oregon) | AES-256 | TLS 1.2+ | N/A (stateless) |
| User accounts & session data | Railway — PostgreSQL 16 | US-West (Oregon) | AES-256 | TLS 1.2+ | Daily automated snapshots, 7-day retention |
| LangGraph agent checkpoints | Railway — PostgreSQL 16 | US-West (Oregon) | AES-256 | TLS 1.2+ | Daily automated snapshots, 7-day retention |
| API response cache (hero stats, platform stats) | Railway — Redis | US-West (Oregon) | AES-256 | TLS 1.2+ | In-memory only; 600 s TTL, no persistent backup needed |
| Graph algorithm workloads | Railway — Memgraph | US-West (Oregon) | AES-256 | TLS 1.2+ | Reconstructable from Neo4j; no separate backup required |
PostgreSQL stores account records (email, hashed credentials via Clerk, subscription tier, and session tokens). No student PII, no test scores, and no individually identifiable school-staff data is stored in PostgreSQL.
Neo4j (Railway) — Knowledge Graph Databases
Schools DB (105K schools) and Curriculum DB (standards, materials)
ThinkKits operates two Neo4j graph databases (Schools and Curriculum) deployed on Railway in the United States. Data does not leave the US region for production workloads. Encryption in transit uses TLS; encryption at rest follows Railway volume and Neo4j deployment settings documented in our security overview.
| Database | Data Types Stored | Source | Region | Encryption at Rest | Encryption in Transit | Backup |
|---|---|---|---|---|---|---|
| Schools graph | 105,000+ public school records: NCES IDs, school names, district names, Title I status, enrollment counts, demographic aggregates (no individual-level data), state proficiency rates, geographic coordinates, framework mappings (CCSS, TEKS, PA Core, FL BEST, VA SOL) | NCES Common Core of Data, EDGE geocodes, state DOE open datasets | US (Railway) | AES-256 (volume / Neo4j) | TLS 1.3 | Railway volume snapshots and/or scheduled exports — retention per ops runbook |
| Curriculum graph | Curriculum standards (CASE-aligned), physical supply catalog, ThinkKits product nodes (BluebonnetMaterial, ThinkkitKit), math concepts, funding rules, state certification data, alignment scores | IMS Global CASE API, publisher open data, internal product catalog | US (Railway) | AES-256 (volume / Neo4j) | TLS 1.3 | Railway volume snapshots and/or scheduled exports — retention per ops runbook |
All demographic and proficiency data is aggregated at the school or district level as published in federal and state open datasets. ThinkKits does not ingest, store, or process any individual student records (no names, IDs, test scores, or personally identifiable information).
Pinecone — Vector Search & Agent Memory
Semantic search index for curriculum, session memory, and help content
Pinecone hosts a single managed index (thinkkits-main) on Amazon Web Services, us-east-1 (N. Virginia). Pinecone is SOC 2 Type II certified.
| Namespace | Data Types Stored | Region | Encryption at Rest | Encryption in Transit | Backup |
|---|---|---|---|---|---|
| curriculum-docs | Vector embeddings of curriculum standards text, product descriptions, alignment notes — no PII | AWS us-east-1 | AES-256 | TLS 1.2+ | Reconstructable from source; Pinecone provides pod-level replication |
| help-center | Vector embeddings of public help documentation text — no PII | AWS us-east-1 | AES-256 | TLS 1.2+ | Reconstructable from source |
| session-handoffs | Internal AI agent session summaries (operational metadata, no user PII) | AWS us-east-1 | AES-256 | TLS 1.2+ | Internal operational data only; reconstructable |
| agent-memory | Internal AI agent dispatch logs and learned operational preferences (no user PII) | AWS us-east-1 | AES-256 | TLS 1.2+ | Internal operational data only; reconstructable |
Cloudflare — CDN, DNS & DDoS Protection
Content delivery, TLS termination, WAF, and tunnel access
Cloudflare sits in front of all ThinkKits traffic. Edge nodes are distributed globally, but origin servers remain in the US. Cloudflare does not store application data; it caches static assets and terminates TLS. ThinkKits uses Cloudflare Tunnel for secure agent access.
| Data Type | Where Processed | Retention | Encryption in Transit |
|---|---|---|---|
| HTTP request logs (IP, URL, timestamp) | Cloudflare global edge; logs accessible from US account | 72 hours (Cloudflare default); not forwarded to ThinkKits storage | TLS 1.3 |
| Static asset cache (JS, CSS, images) | Global edge PoPs — no personal data | Per cache-control headers; no personal data cached | TLS 1.3 |
| WAF / DDoS signals | Cloudflare edge — pattern matching only, content not stored | Aggregate threat analytics only, no PII retained | TLS 1.3 |
| Tunnel traffic (agent access) | Encrypted tunnel — Cloudflare cannot read payload | No content retained by Cloudflare | TLS 1.3 end-to-end |
Because Cloudflare is a CDN, HTTP request metadata (IP address, requested URL, timestamp) may transit edge nodes outside the US. No application payload data, user credentials, or school records are cached or stored at edge nodes. All personal data is processed and stored only in US-region origin systems described in this document.
Clerk — Authentication & Identity
User sign-up, login, session management, and MFA
Clerk manages all ThinkKits user authentication. Clerk is hosted on Amazon Web Services in the United States. Clerk is SOC 2 Type II certified and CCPA-compliant. See Clerk Privacy Policy for the authoritative sub-processor disclosure.
| Data Type | Region | Encryption at Rest | Encryption in Transit | Backup |
|---|---|---|---|---|
| User email addresses | AWS US | AES-256 | TLS 1.2+ | Clerk managed — continuous replication |
| Hashed passwords / OAuth tokens | AWS US | bcrypt + AES-256 | TLS 1.2+ | Clerk managed — continuous replication |
| Session tokens & MFA state | AWS US | AES-256 | TLS 1.2+ | Clerk managed |
| Organization membership (districts / vendors) | AWS US | AES-256 | TLS 1.2+ | Clerk managed — continuous replication |
Stripe — Payment Processing
Subscription billing, invoicing, and payment method storage
Stripe processes all ThinkKits subscription payments. Stripe is PCI DSS Level 1 certified — the highest level of payment card industry compliance. ThinkKits never stores raw card numbers; Stripe handles all cardholder data via tokenization. Stripe is incorporated in the United States; core data infrastructure is US-based.
| Data Type | Stored By | ThinkKits Stores | Compliance |
|---|---|---|---|
| Payment card numbers | Stripe (tokenized vault) | Never stored by ThinkKits | PCI DSS Level 1 |
| Billing name & address | Stripe | Customer ID and tier only | PCI DSS Level 1 |
| Invoice history | Stripe | Subscription status reference | PCI DSS Level 1 |
| Purchase order references (district invoicing) | Stripe | PO number in PostgreSQL for fulfillment | PCI DSS Level 1 |
Anthropic — AI Processing (Claude API)
Natural language processing for funding intelligence and curriculum alignment
ThinkKits uses the Anthropic Claude API for AI-powered features including funding mechanism analysis, curriculum alignment scoring, and search. All API calls are processed in the United States. Anthropic's standard API agreement provides the following data handling guarantees:
Under Anthropic's commercial API terms, inputs and outputs submitted via the API are not used to train or improve Anthropic models. Data is processed transiently and not retained after the API response is returned. See Anthropic's Privacy Policy for the current authoritative statement.
| Data Sent to Anthropic API | Contains PII? | Retention by Anthropic | Processing Region |
|---|---|---|---|
| Funding mechanism analysis prompts School name, district name, Title I status, funding gap |
School-level aggregates only | No retention | United States |
| Curriculum alignment queries Standard identifiers and material descriptions |
No PII | No retention | United States |
| Search and Q&A queries User search text, retrieved context |
May include school names | No retention | United States |
Prompts constructed by the ThinkKits platform are limited to school-level and district-level aggregates sourced from public federal datasets. No individual student names, IDs, assessment scores, or FERPA-protected records are included in API requests.
Sub-processor Summary
All third-party services that may process ThinkKits user or school data
| Sub-processor | Purpose | Data Category | Region | Certifications |
|---|---|---|---|---|
| Railwayrailway.app | Application hosting, PostgreSQL, Redis, Memgraph | Account data, session state, caches | US-West (Oregon) | SOC 2 |
| Neo4jneo4j.com (engine; graphs run on Railway) | Knowledge graph — school records and curriculum standards | Aggregated public school data, curriculum metadata | US (Railway) | Neo4j + Railway controls |
| Pinecone (AWS)pinecone.io | Vector search for curriculum and help center content | Text embeddings — no PII in vectors | AWS us-east-1 | SOC 2 Type II |
| Cloudflarecloudflare.com | CDN, DDoS protection, WAF, Tunnel | HTTP request metadata (transient); no app data | Global edge / US origin | SOC 2 Type II ISO 27001 |
| Clerk (AWS)clerk.com | User authentication and identity management | Email, hashed credentials, session tokens | AWS US | SOC 2 Type II |
| Stripestripe.com | Payment processing and subscription billing | Payment tokens, billing address, invoice history | US | PCI DSS Level 1 SOC 2 |
| Anthropicanthropic.com | Claude AI API — language model inference | Query text (transient, no retention) | US | No training on API data |
Data Processing Agreements & Procurement Support
What districts need to complete vendor approval and DPA review
Available for District Procurement
ThinkKits can provide the following documentation to support your district's vendor review, IT security assessment, or DPA process:
- Signed Data Processing Addendum (DPA) aligned to your state's standard template
- FERPA compliance attestation
- COPPA compliance statement (ThinkKits does not collect data from students under 13)
- SDPC National Data Privacy Agreement (NDPA) v2.1 alignment summary
- Sub-processor disclosure list (this page, exportable as PDF)
- Penetration test summary (executive summary available on request)
- Security questionnaire responses (SIG Lite, CAIQ, or district-specific)
- Business Associate Agreement (BAA) — not applicable; ThinkKits does not process PHI
Most procurement reviews are completed within 5 business days. For urgent timelines, contact your account manager directly.
ThinkKits processes only publicly available school-level data and does not access, store, or process student education records as defined under FERPA. ThinkKits is not a "school official" under FERPA. Our data sources are public federal datasets (NCES Common Core of Data, USASpending.gov) and state open data portals — not student information systems.
Questions from your procurement team?
Our team responds to security questionnaires, DPA requests, and IT review packets. Reach out with your district name and we will route you to the right person.