Academic Intelligence
Subprocessor List
Overview of organisations that may process personal data in connection with CheckItQuick. This list is for schools, data protection officers and procurement teams.
This list reflects our processors and controller-directed integrations as of the last-updated date on this page. We may onboard or replace vendors where necessary to provide the Service.
Controller-directed school systems (iSAMS and MySchoolPortal)
iSAMS and MySchoolPortal are not appointed by us as subprocessors in the ordinary sense. They are school-selected systems and integrations. The school remains responsible for its own contracts, permissions and instructions with those providers. We connect to them only using credentials and configuration the school supplies. We list them here so you can see the full data flow, not because we hold processor-to-processor agreements with those vendors on the school's behalf.
Changes and objections. Where your agreement requires formal notice of subprocessor changes, we provide updates through the nominated contact or product channels. If we intend to add or replace a material subprocessor for personal data processed on your behalf, you may object on reasonable data protection grounds within 14 days of our notice, as set out in our Data Processing Agreement. If you object, we will work with you in good faith; where we cannot resolve the objection, you may be entitled to terminate in line with your agreement.
For additional supplier paperwork (registered addresses, specific SCC references), contact [email protected].
| Legal entity (trading name) | Role | Purpose | Typical personal data / categories | Primary location | International transfers | DPA / terms (overview) | Pupil or parent data? |
|---|---|---|---|---|---|---|---|
| OVH SAS (OVHcloud) | Subprocessor (hosting) | VPS hosting: application runtime, networking, containers; backups on this infrastructure. | Configuration, credentials, operational logs, application data; transient parent/pupil data during requests. | OpenStack os-uk2, London (UK). | UK primary hosting; see OVH contractual documentation for group processing. | OVHcloud agreements | May appear in logs or transient processing when schools use workflows. |
| Neon, Inc. (Neon) | Subprocessor (database) | Managed PostgreSQL for application data, configuration, credentials, metadata. | School settings, secrets, staff linkage, billing refs, log metadata, Data Protection keys. | AWS eu-west-2 (London), UK. | UK region primary; US provider — IDTA/SCC-style terms per Neon documentation. | Neon compliance | Incidental in DB if exposed through workflows. |
| Brevo SAS (Brevo) | Subprocessor (email) | Transactional/operational email where enabled. | Recipient addresses, message bodies, send metadata. | EU-focused (per Brevo). | EU processing; Brevo DPA and standard terms. | Brevo legal | Possible in notifications to parents/staff if configured. |
| Zoho Corporation (Zoho Mail) | Subprocessor (email) | Corporate mailboxes for support and operations. | Email content and headers. | Per Zoho regions. | Mechanisms per Zoho DPA where data leaves the UK. | Zoho privacy | Usually staff; may include parent details in threads. |
| Stripe Payments Europe, Ltd; related Stripe entities (Stripe) | Subprocessor (payments) | Subscription billing where used. | Billing contact, payment metadata, transactions. | Per Stripe (UK/EU entities often apply). | Stripe DPA / IDTA / SCCs as applicable. | Stripe legal | Typically no; payer contact may be parent. |
| Google LLC (Google) | Subprocessor (authentication) | Sign in with Google for school staff admins where configured. | Google profile id, name, email; OAuth handling. | Global Google infrastructure. | Google offers contractual terms and recognised transfer tools for authentication services (see Google documentation). | Google Privacy | Staff/admin; parents normally use MySchoolPortal SSO. |
| GitHub, Inc. | Subprocessor (CI) | Source control and CI/CD; no production pupil DB in repos. | Code, commit metadata, workflow logs. | Primarily US. | GitHub DPA / SCC-style terms. | GitHub terms | No by design. |
| Your school's iSAMS provider (legal name per school contract) | Controller-directed (not ordinary subprocessor) | MIS API as configured by the school. | Per school iSAMS exposure. | Per school’s arrangements. | School governs transfers. | School’s vendor agreement | Yes when school exposes those fields. |
| MySchoolPortal (entity per school contract) | Controller-directed (not ordinary subprocessor) | SSO / portal identity as configured. | Identity claims, SSO metadata. | Per school contract. | School governs. | School’s agreement | Yes for linked parent/staff accounts. |
Registered office for Academic Intelligence Ltd is in the site footer and policies. Company number 17204358. Last updated: 12 May 2026.