Sub-processors
Two sub-processors. That’s it.
We keep our sub-processor list short on purpose — fewer parties mean fewer places your data has to live, and fewer agreements your DPO has to review. Each one processes data only on our instructions, under a data processing agreement.
Last reviewed: May 2026. We’ll notify schools by email if this list materially changes.
Microsoft Azure
UK South (London)What they do. Hosting (Container Apps), primary data store (Cosmos DB), evidence storage (Blob Storage), automated moderation (AI Content Safety), transactional email (Azure Communication Services) — sign-in links, approval emails, attestation invites and notifications.
What data they touch. All pupil records, photo / video evidence, captions and notes, audit log entries, and transactional email (recipient address + email body — no pupil records or evidence).
Transfer basis. No transfer — data, including transactional email, stays in the UK. Contracting entity: Microsoft Ireland Operations Ltd. DPA: Microsoft Products and Services DPA.
Stripe
Ireland / United StatesWhat they do. Payment processing for school Active Pupil Pack purchases. Families never make payments through the platform.
What data they touch. Card details (handled directly by Stripe — we never see them), school billing email, transaction reference, amount and outcome.
Transfer basis. Covered by Standard Contractual Clauses + UK International Data Transfer Addendum.
What you can rely on
The constraints we hold ourselves to.
- Pupil records and evidence stay in Azure UK South — they are never transferred to a US sub-processor
- Transactional email stays in the UK too (Azure Communication Services) — only card payments (Stripe) leave the UK
- No advertising, no analytics, no profiling — none of these sub-processors receive content for those purposes
- No AI training on pupil data — neither Microsoft nor any other provider retains pupil content to train models
- Opt-in push notifications carry only a generic, PII-free alert and an in-app link — never pupil names, evidence or free text; Web Push payloads are encrypted to the device, so the push gateways (Apple / Google / Mozilla / Expo) can’t read them
- Material changes to this list are notified to schools by email
- Schools can request the underlying data processing agreements at any time
Questions? hello@stripesquest.com