Sub-processors
Last updated: May 12, 2026
Per our Data Processing Agreement, ChapterOps will notify districts at least 30 days before adding a new sub-processor. Districts may object to any new sub-processor within that window by contacting ben@chapterops.com.
| Vendor | Country | Student Data? | Compliance | Purpose |
|---|---|---|---|---|
| Vercel | USA | Yes | SOC 2 Type II, GDPR DPA | Hosting / CDN — serves all ChapterOps application traffic. Processes all request and response bodies in-flight, including those containing student data. |
| Supabase | USA (AWS us-east-1) | Yes | SOC 2 Type II, GDPR DPA, HIPAA-eligible infrastructure | PostgreSQL database, authentication, and file storage for all chapter data, including member records, trip data, permission slips, and uploaded photos. |
| Stripe | USA | No | PCI DSS Level 1 Service Provider, SOC 2 Type II, GDPR DPA | Payment processing for trip fees collected from parents. ChapterOps never receives raw card data — Stripe collects and processes it directly. |
| Twilio | USA | Yes | ISO 27001, SOC 2 Type II, GDPR DPA | SMS delivery for trip reminders, permission-slip alerts, and emergency notifications. Messages are sent only to recipients who have provided explicit TCPA opt-in consent. |
| Resend | USA | Yes | SOC 2 Type II (in progress as of 2026), GDPR DPA | Transactional email delivery (invitations, permission-slip confirmations, data-request acknowledgments). |
| Sentry | USA | No | SOC 2 Type II, GDPR DPA | Error tracking and performance monitoring. Stack traces and request metadata are sent when errors occur. PII scrubbing is enabled in production. |
| Anthropic | USA | No | SOC 2 Type II, GDPR DPA | AI-assisted CSV column mapping (opt-in per chapter). Sends column headers and up to 3 sample values per ambiguous column — not full roster data. Anthropic does not use API inputs for model training per their standard API terms. |
Questions about sub-processors? Email ben@chapterops.com with subject “Sub-processor inquiry.”
Districts that have signed a DPA with ChapterOps are automatically subscribed to receive 30-day advance notice of sub-processor changes at the email address provided in their DPA.