Sub-processor List
Cognivio uses the sub-processors below to provide the Service. Each is bound by written data-protection terms no less protective than our Data Processing Addendum (DPA). We give Customers at least 30 days' notice before adding or replacing a sub-processor (DPA clause 7.2). Cognivio itself operates from Israel, which is covered by EU and UK adequacy decisions.
| Sub-processor | What it does | Data it receives | Location | Transfer basis | Notes |
|---|---|---|---|---|---|
| MongoDB Inc. (Atlas, on AWS) | Main database and backups | Account data, analysis, feedback, goals | Israel (AWS il-central-1) | EU and UK adequacy for Israel | Encrypted at rest (AES-256), including backups |
| Cloudflare Inc. (R2) | Storage of recordings and images | Recordings, teacher reference photos, blurred renders | European Union | Within the EEA; UK adequacy for the EEA | Encrypted at rest (AES-256); private storage reached only through time-limited signed links |
| Railway Corp. | Application hosting and processing | All data, in transit and in processing | United States | EU-US Data Privacy Framework (and its UK Extension) where Railway is certified; otherwise the Standard Contractual Clauses, with the UK Addendum for UK data (Railway DPA) | |
| Google LLC (Gemini API, paid service) | AI face detection and lesson analysis | Unblurred recordings; frames of blurred recordings for quality checks; teacher reference photos where used to recognise the teacher | United States | EU-US Data Privacy Framework and its UK Extension (Google LLC is certified) | Cognivio deletes each file it uploads once the request it was uploaded for is complete; a file not deleted that way expires on Google’s side after about 48 hours. Google does not use prompts, files or responses to improve its products, and keeps prompts and outputs for 55 days solely to detect and prevent abuse. |
| Anthropic PBC (Claude) | AI coaching assistant | Analysis and feedback text; no recordings or images | United States | Standard Contractual Clauses (Modules 2 and 3), with the UK Addendum for UK data (Anthropic DPA, effective 24 February 2025) | Uses our data only to provide its service; not used to train its models |
| Resend Inc. | Account emails (invitations, password resets) | Name, email address | United States | Standard Contractual Clauses, with the UK Addendum for UK data (Resend DPA, signed 3 September 2026) |