Last Updated: June 1, 2026
This page lists the third-party service providers (“Subprocessors”) that Sukrat AI uses to operate the platform and process data on our behalf. Each is bound by a data processing agreement that restricts their use of data to delivering the contracted service and prohibits AI training on student data.
For how we protect your data and the privacy commitments that apply to each category below, see our Privacy Policy.
Infrastructure and Database
Supabase
Purpose: Database, authentication, and Row-Level Security enforcement
Data Processed: Student accounts, mastery state, session data, assessment responses (encrypted at rest). Student data is stored in the EU region.
Website: supabase.com
DigitalOcean
Purpose: Backend API hosting, ML pipeline compute, and object storage (uploaded course materials)
Data Processed: Backend request metadata; uploaded school curriculum materials stored under account-namespaced paths
Website: digitalocean.com
Vercel
Purpose: Next.js frontend hosting and CDN
Data Processed: Web request metadata (no student learning data)
Website: vercel.com
Cloudflare
Purpose: CDN, DDoS protection, and Web Application Firewall (WAF)
Data Processed: Request metadata and IP addresses, retained under Cloudflare's DPA
Website: cloudflare.com
AI Model Providers
All AI providers below receive anonymized curriculum prompts only — no student PII (name, email, school affiliation) is included. No student data is used to train third-party AI models. This is enforced architecturally and required by contract.
Anthropic
Purpose: AI tutoring content generation (Claude API)
Data Processed: Anonymized curriculum prompts (question text, syllabus reference, mastery context) — no student PII
Website: anthropic.com
OpenAI
Purpose: AI content generation and evaluation (GPT-4o API)
Data Processed: Anonymized curriculum prompts — no student PII
Website: openai.com
Google (Gemini API)
Purpose: Visual and diagram content generation
Data Processed: Anonymized curriculum prompts — no student PII
Website: ai.google.dev
DeepSeek
Purpose: AI evaluation experiments
Data Processed: Anonymized curriculum prompts — no student PII. DeepSeek is used only in Pakistan-region evaluation experiments and is contractually excluded from all US-facing deployments and any workflow involving student personally identifiable information, given data residency concerns.
Website: deepseek.com
Observability and Quality
Langfuse
Purpose: AI quality evaluation and safety auditing
Data Processed: Anonymized AI evaluation traces — no student PII
Website: langfuse.com
Sentry
Purpose: Application error monitoring and debugging
Data Processed: Error logs with PII scrubbed before transmission; no student learning data
Website: sentry.io
Analytics
PostHog
Purpose: Product analytics and UX improvement
Data Processed: Anonymized usage events (pages visited, features used, session duration) — no PII transmitted
Website: posthog.com
Payment Processing
Stripe
Purpose: Subscription billing and payment processing
Data Processed: Payment and billing metadata only (subscription status, invoice records). Sukrat does not store card numbers, CVVs, or bank account details.
Website: stripe.com
Resend
Purpose: Transactional email delivery (account confirmations, password reset, notifications)
Data Processed: Email address and message metadata
Website: resend.com
Updates to This List
We may add, remove, or replace subprocessors as the platform evolves. We will update this page and the “Last Updated” date when changes occur. For institutional customers, material subprocessor changes will be communicated with advance notice as specified in the school agreement or DPA.
Contact
If you have questions about subprocessors or our data processing practices, contact: privacy@sukrat.ai
Last Modified: June 1, 2026
Version: 2.0