Active subprocessors
- Vercel Inc. — application hosting, serverless compute, and CDN for math.foundation and app.math.foundation. Processes all request data in transit, including IP address. Global edge network.
- Neon Inc. — managed PostgreSQL database for the application. Stores learner records, skill state, diagnostic sessions, school and family records, and subscription state. Hosted in ap-southeast-2 (Sydney, Australia).
- Stripe, Inc. — payment processing and subscription billing. Processes buyer name, email, billing address, and card details. Card details are entered directly with Stripe and are never collected or stored by Math Foundation. PCI-DSS compliant.
- Resend — transactional email delivery, including magic-link sign-in, receipts, and digests. Processes recipient email address and message content.
- Anthropic PBC — AI model provider for tutoring explanations and misconception diagnosis. Processes the learner's answer content and skill context for the item being worked on. It does not receive learner names, email addresses, or school identifiers.
Configured but not active
- Google LLC — Google OAuth sign-in for teacher and school-administrator accounts. The redirect URI is configured, but OAuth credentials are not yet populated in production, so this route is not currently available to users. When enabled, Google will process the account email address for sign-in only.
Not enabled
- Voice transcription is disabled in production. The application contains an optional speech-to-text path that would send recorded audio to a Whisper-compatible endpoint, but it fails closed unless explicitly enabled and is not switched on. No audio leaves the browser today.
Changes to this list
We will update this page before adding a subprocessor that processes learner data. Schools with a written agreement that requires advance notice of subprocessor changes should record that requirement in the agreement; contact privacy@math.foundation.
Contact
Data processing enquiries: privacy@math.foundation.