# Backpack Education — Subprocessor List

Backpack Education — version 2026.1 — September 21, 2026

This is the list of third parties that may receive or process covered information on Provider's behalf in delivering Backpack Education. Provider gives a district's Data Steward 30 days' written notice before adding a subprocessor. This list is versioned; each version is signed by Provider.

| Subprocessor | Function | Data | Location |
| --- | --- | --- | --- |
| Vercel, Inc. | Application hosting, edge network, scheduled jobs | All application data in transit; no persistent student data at rest beyond request logs (retained 7 days, identifiers redacted) | United States |
| Neon, Inc. | Managed PostgreSQL database | All data in the schedule of data, encrypted at rest (AES-256) and in transit | United States (us-east) |
| Google LLC, YouTube Data API | Video metadata lookup and privacy-enhanced playback embed | Video identifiers only. No student identity is sent. Playback uses youtube-nocookie.com | United States |
| Google LLC, Workspace | Provider's internal email and document storage for contract administration | Contract documents and district contact details; no student data | United States |
| Stripe, Inc. | Invoicing of district fees | District billing contact and purchase order; no student data | United States |
| Transactional email provider | Delivery of notices, digests, and document room messages | Recipient email address and message content (guardian name, child's first name in a digest) | United States |

## Not used

No analytics, advertising, session-recording, or AI-model training service receives covered information. Backpack's consumer product uses a separate subscription platform that is disabled at the code level for every district tenant.

## Sub-subprocessors

Each subprocessor above engages its own infrastructure providers (for example, Neon and Vercel run on Amazon Web Services). Provider relies on each subprocessor's published data processing terms and SOC 2 reports, available on request.