---
title: "Subprocessors and Service Providers | Ilmiya"
description: "Ilmiya's service providers, their purposes, the information they handle, and the features they support."
url: "https://ilmiya.com/sub-processors-list/"
language: "en"
---

# Subprocessors and Service Providers

Ilmiya's service providers, their purposes, the information they handle, and the features they support.

Ilmiya, Inc. engages the providers below to deliver and protect its services. This register identifies their roles and the categories of information involved. The providers used for an organization depend on its enabled features, selected services and applicable agreement.

A subprocessor processes personal information for Ilmiya on a customer’s behalf. A provider may separately process business information for its own purposes under applicable law, including payment or fraud-prevention activities. Our [Global Privacy Policy](https://ilmiya.com/privacy-policy/) explains Ilmiya’s business and website processing. The [Data Protection Addendum](https://ilmiya.com/data-protection-addendum/) (DPA) governs processing on behalf of customers.

<a id="our-providers"></a>

 

<a id="current-sub-processors"></a>

 

<a id="infrastructure-and-hosting"></a>

 

<a id="data-and-analytics"></a>

 

<a id="communications"></a>

 

<a id="payments"></a>

<a id="current-sub-processors-and-service-providers"></a>

## Current Sub-Processors and Service Providers

The table describes the information relevant to each provider’s role. A provider receives information only where the corresponding service or feature is used; this register does not authorize access to every customer’s records. Information submitted in prompts, messages, uploaded content or support requests may contain personal information. Using coded identifiers or removing direct identifiers does not necessarily make that information anonymous.

**Entity country** identifies the country of the listed reference company. It is separate from the location of Customer Data: Ilmiya’s Customer Data is currently hosted, stored and processed in the United States, including data received from customers and users elsewhere. Each company appears once; Google services are consolidated, and Voyage AI is separately identified as an entity within MongoDB.

| Provider / reference entity | Entity country | Service purpose | Information involved | Service or feature scope | Privacy policy |
| --- | --- | --- | --- | --- | --- |
| [Amazon Web Services, Inc.](https://aws.amazon.com/) | United States | Cloud infrastructure and application hosting | Account and organization records, learning content and request metadata processed by the hosted application services. | Services deployed on AWS; the applicable hosting arrangement determines the records involved. | [Privacy policy](https://aws.amazon.com/privacy/) |
| [Anthropic, PBC](https://www.anthropic.com/) | United States | AI model inference | Prompts, learner or educator messages, relevant instructional context and generated responses. | Enabled AI features routed to Anthropic, including configured educational agents. | [Privacy policy](https://www.anthropic.com/legal/privacy) |
| [Axiom, Inc.](https://axiom.co/) | United States | Operational monitoring and diagnostics | Logs, traces, request and device metadata, account or organization identifiers, and diagnostic context. | Applications and infrastructure configured to send operational telemetry. | [Privacy policy](https://axiom.co/docs/legal/privacy) |
| [Cloudflare, Inc.](https://www.cloudflare.com/) | United States | Hosting, content delivery, security, application storage and communications | Files and application records, messages and voice data in transit, support cases and attachments, website inquiries, email content and network metadata. | Website and support services; platform storage, realtime or voice transport and AI gateway functions where enabled. | [Privacy policy](https://www.cloudflare.com/privacypolicy/) |
| [DigitalOcean, LLC](https://www.digitalocean.com/) | United States | Application and frontend hosting | Browser and network request metadata, and information processed by services deployed on its infrastructure. | Applications hosted on DigitalOcean under the applicable deployment arrangement. | [Privacy policy](https://www.digitalocean.com/legal/privacy-policy) |
| [Fireworks AI (Fireworks.ai, Inc.)](https://fireworks.ai/) | United States | AI model inference | Prompts, submitted content, relevant instructional context and model outputs. | Enabled AI features routed to Fireworks AI. | [Privacy policy](https://fireworks.ai/privacy-policy) |
| [Google LLC](https://about.google/) | United States | Cloud infrastructure and enabled AI and speech services | Records handled by hosted services; prompts, messages, instructional context, audio for transcription, text for speech generation and resulting outputs. | The Google hosting, AI or speech service selected for an enabled feature. The applicable service terms and configuration govern each use. | [Privacy policy](https://policies.google.com/privacy) |
| [HubSpot, Inc.](https://www.hubspot.com/) | United States | Customer relationship management and website marketing | Business contact details, organization information, communications and website interaction identifiers where marketing consent is given. | Prospective and existing customer relationships; consent-based marketing on the public website. | [Privacy policy](https://legal.hubspot.com/privacy-policy) |
| [Microsoft Corporation](https://www.microsoft.com/) | United States | Cloud AI inference, speech and voice services | Prompts and responses; audio, transcripts, text for speech generation, pronunciation results and relevant learner context. | Enabled Azure AI, speech, pronunciation and voice features routed to Microsoft. | [Privacy policy](https://www.microsoft.com/en-us/privacy/privacystatement) |
| [MongoDB, Inc.](https://www.mongodb.com/) | United States | Managed databases and information retrieval | Account and institution records, learning content, messages, stored application records and retrieval vectors held in the relevant databases. | Applications using MongoDB databases and retrieval services. The separate Voyage AI row describes embedding processing. | [Privacy policy](https://www.mongodb.com/legal/privacy/privacy-policy) |
| [New Relic, Inc.](https://newrelic.com/) | United States | Application and infrastructure monitoring | Performance measurements, request and device metadata, diagnostic events, user identifiers and interaction replay where configured. | Applications and infrastructure with New Relic monitoring enabled; replay applies only to configured surfaces. | [Privacy policy](https://newrelic.com/termsandconditions/privacy) |
| [OpenAI OpCo, LLC](https://openai.com/) | United States | AI model inference | Prompts, submitted content, relevant instructional context and model outputs. | Enabled AI features routed directly to OpenAI. Features supplied through Microsoft’s services are covered by the Microsoft row. | [Privacy policy](https://openai.com/policies/privacy-policy/) |
| [PlanetScale, Inc.](https://planetscale.com/) | United States | Managed databases | Application records and account or organization identifiers stored in databases assigned to this provider. | Applications using PlanetScale databases under the applicable service arrangement. | [Privacy policy](https://planetscale.com/legal/privacy) |
| [PostHog, Inc.](https://posthog.com/) | United States | Website analytics and diagnostics | Page and interaction events, browser or session identifiers, device information, errors, performance traces and sampled session replay. | Public website analytics after Analytics consent; designated form fields and messages are masked in replay. | [Privacy policy](https://posthog.com/privacy) |
| [Redis Inc.](https://redis.io/) | United States | Managed caching and data services | Temporary application records, identifiers and related information held in the configured data service. | Applications using managed Redis services; the applicable configuration determines the information involved. | [Privacy policy](https://redis.io/legal/privacy-policy/) |
| [Resend (Plus Five Five, Inc.)](https://resend.com/) | United States | Transactional email delivery | Recipient addresses, names, organization details, email content and delivery metadata. | Product email routes configured to use Resend, including account, invitation and support communications. | [Privacy policy](https://resend.com/legal/privacy-policy) |
| [Stripe, LLC](https://stripe.com/) | United States | Payment processing and subscription billing | Billing contacts, organization identifiers, subscription and transaction information, and payment information provided for checkout. | Customer billing and payment services. Stripe’s role depends on the payment, fraud-prevention or other activity involved. | [Privacy policy](https://stripe.com/privacy) |
| [Voyage AI Innovations, Inc.](https://www.voyageai.com/) | United States | Embeddings for search and retrieval | Course or source text, retrieval questions, relevant submitted content and the resulting numerical representations. | Enabled embedding and retrieval features using Voyage services, including applicable MongoDB AI routes. | [Privacy policy](https://www.voyageai.com/privacy) |

A provider may receive ordinary network and service metadata when handling a request. The purposes and service scopes above govern the information sent through Ilmiya’s integrations. A provider’s privacy notice describes its wider practices; the applicable business agreement and data-processing terms govern its handling of Customer Data for Ilmiya.

A customer-selected external integration is governed by the [Third-Party and Integrations Policy](https://ilmiya.com/third-party-integrations-policy/). Its presence in an institution’s environment does not by itself make that provider an Ilmiya subprocessor. Optional website analytics and marketing are governed by the [Cookie Notice](https://ilmiya.com/cookie-notice/).

<a id="data-processing-location"></a>

## Data Processing Location

Customer Data is currently hosted, stored and processed in the United States, including information supplied by institutions and users in other countries. The entity-country column identifies a provider company and does not describe a separate regional hosting arrangement. The DPA governs the international-transfer safeguards applicable to that processing.

<a id="protecting-your-information"></a>

<a id="sub-processor-requirements"></a>

## Sub-Processor Requirements

Before a subprocessor handles Customer Data, Ilmiya assesses its safeguards and requires a written agreement covering confidentiality, security, permitted processing, deletion and assistance with privacy requests. Access must be limited to the information needed for the assigned service. Ilmiya remains responsible for the subprocessor obligations established by the DPA.

Each subprocessor must process Customer Data only on Ilmiya’s documented instructions for the authorized service, apply appropriate technical and organizational measures, and bind personnel with access to confidentiality. It must comply with the data-protection duties applicable to its role. Engagement of a subprocessor does not reduce Ilmiya’s obligations or responsibility under the DPA.

Subprocessors must not use Customer Data for advertising or to train their AI models. Ilmiya does not currently train models on Customer Data. Any future customer-specific model customization requires a separate written, lawful opt-in; it does not permit third-party model training.

The DPA’s retention and deletion requirements apply to Customer Data handled by subprocessors. A provider’s general retention policy does not enlarge the retention period authorized under the customer’s agreement. Provider access must also comply with applicable international transfer requirements and the processing locations agreed for the service.

The functions in this register and the services selected by the customer determine which providers handle its Customer Data. The standard processing location is the United States. Contact [legal@ilmiya.com](mailto:legal@ilmiya.com) for information about a provider’s role or the applicable transfer safeguards.

<a id="changes-and-objections"></a>

## Changes and Objections

Ilmiya will give the organization’s designated contact at least 30 days’ advance notice before a new or replacement subprocessor handles Customer Data, or before an additional processing country is introduced. The notice will identify the proposed change and the affected processing. Updating this register alone does not replace direct notice.

The organization may raise a reasonable data protection objection during that period. The DPA governs resolution of objections and the right to terminate an affected service with a proportional refund of prepaid unused fees where its conditions are met.

To update your organization’s notice contact or request further information about a provider’s role, email [legal@ilmiya.com](mailto:legal@ilmiya.com).

To request subprocessor change notifications, email [support@ilmiya.com](mailto:support@ilmiya.com) with the subject “Subscribe to Sub-Processor Updates.” This subscription supplements the direct notice given to the organization’s designated contact.

<a id="previous-sub-processors"></a>

<a id="contact"></a>

## Contact

Questions about a current or previously listed provider may be sent to [legal@ilmiya.com](mailto:legal@ilmiya.com) or [support@ilmiya.com](mailto:support@ilmiya.com). The [Global Privacy Policy](https://ilmiya.com/privacy-policy/) explains broader data practices, and the [DPA](https://ilmiya.com/data-protection-addendum/) supplies the contractual protections for Customer Data.

[All legal documents](https://ilmiya.com/legal/)[Contact legal](https://ilmiya.com/legal-inquiry/)

---

[View this page on Ilmiya](https://ilmiya.com/sub-processors-list/) · [All pages in Markdown](https://ilmiya.com/markdown-index.md)