Sub-Processor List — ThinkKits Policies

Third-Party Sub-Processors

ThinkKits works with carefully vetted sub-processors to deliver our education data platform.

Data Processing Agreement status: under audit (April 2026). We are currently reviewing the DPA status of each sub-processor (executed custom DPA vs. clickthrough DPA accepted at signup vs. pending). Current per-vendor DPA status is not published here until that audit is complete. Procurement teams who need current DPA status for vendor vetting should email legal@thinkkits.com — we will respond within three business days.

Service Name	Purpose	Data Processed	Data Location
Clerk clerk.com	User authentication and identity management; session management and multi-factor authentication	User Identity Email Addresses Login History Session Tokens	🇺🇸 United States
Stripe stripe.com	Payment processing, subscription billing management, and invoice generation	Payment Data Billing Info Transaction History Cardholder Name	🇺🇸 United States
Railway railway.app	Application hosting, runtime environment, and managed database services (US region)	Application Data System Logs Deployment Artifacts Environment Config	🇺🇸 United States
Cloudflare cloudflare.com	Content delivery network (CDN), DDoS protection, edge caching, and DNS management	IP Addresses Request Metadata Cached Content Traffic Analytics	🇺🇸 United States
Anthropic / Claude anthropic.com	AI-powered analysis, school data summarization, grant writing assistance, and natural language processing	School & District Data Funding Records User Queries AI Prompt Context	🇺🇸 United States
Neo4j (Railway) neo4j.com	Managed graph database hosting for education knowledge graph — schools, districts, curriculum standards, and funding relationships (US region)	School Records District Data Curriculum Standards Funding Records	🇺🇸 United States
Pinecone pinecone.io	Vector database for semantic search, AI session memory, and embedding-based retrieval	Search Embeddings Session Memory Query Vectors Content Vectors	🇺🇸 United States
Sentry sentry.io	Application error tracking, performance monitoring, and crash reporting	Error Logs Stack Traces Performance Data Debug Context	🇺🇸 United States
PostHog posthog.com	Product analytics, user behavior tracking, feature flag management, and funnel analysis	Usage Events Feature Interactions Session Recordings Anonymous User IDs	🇺🇸 United States

Data Protection Standards

All sub-processors are required to meet or exceed ThinkKits' data protection standards:

Data Processing Agreements (DPAs) — Contractual obligations for data handling and processing limits
Security Certifications — SOC 2 Type II, ISO 27001, or equivalent standards required
Encryption Requirements — Data encrypted in transit (TLS 1.2+) and at rest (AES-256)
Access Controls — Principle of least privilege enforced for all data access
Incident Response — 24-hour breach notification requirements contractually mandated
Regular Audits — Annual security assessments and compliance reviews

Change Management Process

ThinkKits follows a strict process for sub-processor changes:

30-Day Notice — All customers notified before adding new sub-processors
DPA Requirements — New sub-processors must sign DPAs before processing any data
Security Assessment — Comprehensive security review required for all new vendors
Customer Objection Rights — Enterprise customers may formally object to new sub-processors
Documentation Updates — This list updated within 5 business days of any change

FERPA & Student Data Compliance

ThinkKits processes publicly available school and district data sourced from NCES and other federal datasets. No individual student records are processed. All sub-processors handling education-adjacent data are reviewed against FERPA, COPPA, and applicable state student privacy laws.

GDPR Compliance

For EU customers, this sub-processor list satisfies Article 28(2) requirements. All sub-processors processing EU personal data have appropriate Standard Contractual Clauses (SCCs) or adequacy decisions in place.

Contact & Requests

For questions about our sub-processors or to request DPA copies:

Privacy Team: privacy@thinkkits.com
Security Team: security@thinkkits.com
DPA Requests: legal@thinkkits.com