The platform is operated as a data processor for each academy (the data controller of its students' and staff's personal data). To deliver the service, the operator engages the sub-processors below under written data-protection terms consistent with Article 28 GDPR. Where a sub-processor is outside the EU/EEA, transfers rely on the European Commission's Standard Contractual Clauses (SCCs) and/or the vendor's EU–US Data Privacy Framework (DPF) certification, as listed per vendor. Each DPA link points to the vendor's own official document; the line beneath it states what that document currently is — an executed agreement, terms incorporated by reference whose verification is still pending, or an execution step still to be completed.
The status column is read from the configuration of the deployment serving this page (staging) at the time you open it — it is not a manually maintained list. A vendor is shown as active whenever the integration that sends it personal data is enabled here.
This list is maintained under the operator's Vendor & Sub-processor Management Policy, version 1.2 (adopted 14 September 2026): every vendor is risk-assessed and bound by written data-protection terms before it receives personal data, reviewed at least annually and on any material change. Academies receive advance notice of material changes to this list so they may object; every change is recorded in the change log. See also the Privacy Policy.
Active sub-processors in this environment (staging)
These vendors currently process personal data on the academies' behalf as part of delivering the service in this deployment.
| Vendor | Purpose | Personal data | Location / region | Transfer mechanism | Status (staging) | DPA |
|---|---|---|---|---|---|---|
| ElevenLabs | Speech-to-text and the synthesised voice of the speaking interlocutor / AI tutor (text-to-speech + conversational AI) | Candidate raw spoken audio (realtime speech-to-text during Speaking) and exam text to be voiced | United States (EU residency available on the Enterprise tier only) | SCCs (Modules 2 + 3) + EU–US Data Privacy Framework (certified) | Active Speech synthesis, transcription and the live Speaking interlocutor are enabled. | ElevenLabs DPA DPA: Incorporated by reference — verification pending |
| Simli | Photo-real avatar rendering (lip-sync) for the speaking interlocutor / AI tutor | The avatar's own synthesised speech audio and the avatar video it renders, plus session metadata and the learner's IP address. The learner's microphone and camera are never sent to Simli | Norway (EEA) — Simli AS, Oslo; processing in the EEA by default | Processed in the EEA by default (intra-EEA, Norwegian entity). Per-session exceptions only, never by default, including during an EU capacity outage: (a) the live media stream may be carried over LiveKit Cloud's global network while avatar rendering, logs and storage stay in the EEA; and (b) where EU capacity is unavailable for a session, or while Simli has reported an EU capacity outage within the preceding minutes, that session may be processed in Simli's other regions, with transfers under the SCCs in Simli's DPA | Active The photoreal Speaking avatar is enabled. | Simli DPA (v002, Aug 2024) + Amendment No. 1, EU-Only Processing (signed 2026-09-22) DPA: Incorporated by reference — verification pending |
| LiveKit | Realtime WebRTC media transport for the live speaking session (engaged via Simli's avatar service) | The avatar's audio and video stream between Simli and the learner, transported in real time (transient — routed, not recorded or stored), plus connection/session metadata and the learner's IP address | United States (LiveKit Cloud). Used through Simli's EEA-pinned service by default; for individual sessions (e.g. learners outside the EU) the stream may be routed over LiveKit Cloud's global network | SCCs (Modules 1, 2 + 3); DPF self-certification under verification | Active Engaged through the avatar vendor's real-time media transport (no direct credential). | LiveKit DPA (2025-11-18) DPA: Incorporated by reference — verification pending |
| Anthropic | AI-assisted grading, tutoring and coaching of exam responses (Claude) | Candidate written responses, speaking transcripts and tutor/coach context | United States / global (no EU residency for the API) | SCCs (Modules 2 + 3) + UK and Swiss addenda (no DPF reliance) | Active AI grading, feedback and tutoring are enabled. | Anthropic DPA (2025-02-24) DPA: Incorporated by reference — verification pending |
| AWS (Amazon Web Services) | Production infrastructure — compute (Fargate), database (Aurora PostgreSQL), object storage (S3) and secrets management | All authoritative platform data: candidate account data, exam attempts, answers and scores, rosters, credentials (hashed) and the audit log | EU — Frankfurt (eu-central-1); data at rest stays in the selected region | Processing pinned in-region (EU); 2021 SCCs auto-apply to any ancillary transfer; EU–US Data Privacy Framework (certified) | Active Hosts the platform: database, compute and storage. | AWS GDPR DPA (Service Terms §1.14) DPA: Incorporated by reference — verification pending |
| AWS SES | Transactional email — invitations and notifications (per-academy sending domains) | Recipient name and email address, and message content | EU sending region (per tenant) — an AWS service | Covered by the AWS GDPR DPA (row above); in-region EU sending | Active Transactional email is sent through AWS SES. | Covered by the AWS DPA DPA: Covered by the AWS DPA |
| Cloudflare | Content delivery, object storage for exam media (R2), WAF and edge routing | Exam content (audio/images — not per-candidate records) and edge traffic metadata (IP address, host headers) of users transiting the network | Global edge network (EU localisation via a separate Data Localization Suite product) | SCCs (Modules 2 + 3) + EU–US Data Privacy Framework (certified) | Active Serves exam media and edge traffic (object storage, CDN, custom domains). | Cloudflare Customer DPA (v6.4, 2026-04-03) DPA: Incorporated by reference — verification pending |
| Stripe | Payment processing and payouts (Stripe Connect). Dual role: processor for merchant payment processing, and independent controller for fraud detection, loss mitigation and AML/KYC | Billing identifiers, payer name and email, connected-account onboarding data (card data goes to Stripe directly — the platform never stores card numbers) | United States / global (no customer-selectable EU residency) | SCCs (Modules 1 + 2) + UK IDTA + EU–US Data Privacy Framework (certified) | Active Payments and payouts are enabled. | Stripe DPA (2025-11-18) DPA: Incorporated by reference — verification pending |
| Slack | QA reviewer feedback channels (exam-review workflow) | Reviewer identity and report message content (may include exam screenshots); candidate personal data is kept out by policy | United States (EU residency on Business+/Enterprise tiers only) | SCCs (2021, deemed-executed) + DPF via parent Salesforce, Inc. | Active Reviewer feedback and operational alerts are posted to Slack. | Salesforce DPA (Apr 2026, via Slack) DPA: Executed 2026-08-06 |
| GitHub | Source control, CI/CD and the QA feedback dispatch pipeline | Source code and CI logs (no production candidate data by design); QA dispatch payloads carry reviewer report text | United States / global | SCCs (Modules 2 + 3) + EU–US Data Privacy Framework (certified) | Active Hosts the source code and CI; QA reports can trigger fix runs. | GitHub Data Protection Agreement (Oct 2025) DPA: Incorporated by reference — verification pending |
| Sentry | Application error reporting (observability) | Error events and stack traces (may embed user identifiers); no default PII is sent | EU region available (Frankfurt), chosen at organisation creation | SCCs (Modules 2 + 3) + UK Addendum | Active Application error reporting is enabled. | Sentry DPA (v5.1.0, 2024-05-29) DPA: Executed 2026-08-06 |
| OpenAI | Alternate AI model path (tutor / feedback when an OpenAI model is selected) | The same class of data as Anthropic (written responses, speaking transcripts, tutor context) when its model path is used | United States (EU residency at project level, gated) | SCCs (Modules 2 + 3) + UK Addendum (not DPF-listed) | Active An alternate AI model path is enabled (used when an OpenAI model is selected). | OpenAI DPA (v.010126) DPA: Executed 2026-09-14 |
Approved, not active in this environment (staging)
These vendors are approved and integrated but the integration is not enabled in this deployment, so they do not currently receive personal data from it. They are listed for transparency.
| Vendor | Purpose | Personal data | Location / region | Transfer mechanism | Status (staging) | DPA |
|---|---|---|---|---|---|---|
| WorkOS | Staff identity — SSO / AuthKit / directory sync (SCIM) for enterprise academies | Staff and admin identity (name, email, organisation, authentication events) when single sign-on is used | United States (no EU hosting commitment) | SCCs (Modules 2 + 3) — SCC-only (no DPF listing found) | Not active Single sign-on is switched off in this deployment; no identity data is sent. | WorkOS DPA (2023-06-27) DPA: Incorporated by reference — verification pending |
| Resend | Transactional email — alternate provider to AWS SES | Recipient email and message content, when selected as the email provider | United States (no EU residency) | SCCs (Modules 1, 2 + 3) + UK/Swiss addenda; DPF claimed (under verification) | Not active No Resend credential is configured; nothing is sent through Resend. | Resend DPA DPA: Incorporated by reference — verification pending |
| TypeSafe AI | Decision primitives on TOEIC Speaking / Writing verification (text only) — a shadow check beside the served result, never changing it | The text of a TOEIC Writing Q1–5 sentence or a Speaking Q8–10 transcript, with the item's own prompt — no name, e-mail, account or audio | United States (TypeSafe AI, Inc.; hosted in the US per its privacy policy — EU residency to confirm in the DPA) | To confirm in the DPA (SCCs Modules 2 + 3 expected; no EU–US Data Privacy Framework listing verified) | Not active The verification checks are switched off in this deployment; nothing is sent. | TypeSafe privacy policy (DPA to be executed) DPA: Execution pending |
Where the operator is the controller
For the vendors below, the platform operator acts as the data controller in its own right (for example, marketing enquiries from prospective academies). This is a separate legal seat from the candidate-data chain above: no candidate or exam data is involved.
| Vendor | Purpose | Personal data | Location / region | Transfer mechanism | Status (staging) | DPA |
|---|---|---|---|---|---|---|
| HubSpot | B2B sales pipeline (CRM) for the public website's self-serve demo funnel — ProficientHub is the data controller for this processing; one-way platform → HubSpot sync, gated on the consent recorded at the lead form | Prospective-customer contact data (name, work email, academy/company, role, country, phone, demo usage counts) — never candidate or exam data | European Union (EU-hosted portal, account 148302337; HubSpot EU data centre, Frankfurt) | SCCs (Modules 2 + 3) + EU–US Data Privacy Framework (certified) | Active Marketing-lead sync to the CRM is enabled. | HubSpot DPA (2026-04-14) DPA: Incorporated by reference — verification pending |
Stripe additionally acts as an independent controller for its own fraud-detection, loss-mitigation and AML/KYC processing (see its DPA). Sign in with Google is not a sub-processor: when you choose to sign in with a Google Account, Google acts as an independent controller of that account under its own terms. See the Privacy Policy for details.