Subprocessors

This page covers Scolah Compass Platform (“Platform”). It describes, by category, the third parties that may process personal data Scolah holds as your processor under our Data Processing Addendum.

Services that Scolah runs itself on its hosting infrastructure, such as our container registry, our AI service and the models it runs, are not listed as separate subprocessors. They are covered by the cloud infrastructure provider in section 1.

Because your applications run on your own servers, their data does not pass through these subprocessors, with two exceptions: the notifications Scolah delivers for your applications (section 2), and the optional Scolah-managed AI service (section 3). Services you contract for yourself, such as your own SMTP server, your backup store, or a model provider you bring your own key for, are your processors, not ours. They do not appear here. See Data Residency.

Named list. Scolah keeps a register naming each subprocessor, its address and its transfer safeguard. It forms Annex 3 of the DPA. Customers can request it at any time from privacy@scolah.com.

Locations. Scolah and its subprocessors run on infrastructure across several regions. The region that holds your organisation’s data, and where each subprocessor processes it, are recorded in the register. Whenever personal data subject to EU, UK or Swiss law is processed outside those areas, the Standard Contractual Clauses in the DPA apply.

---

1. Always Used

Category	Purpose	Personal data processed	Location	Transfer safeguard
Cloud infrastructure provider	Hosting of the portal, Platform API, database, backups, container registry, and Scolah’s AI service and the models it runs	Portal user names, email addresses, roles and activity log; server and installation records; encrypted installation credentials; IP addresses of servers downloading software; the text of AI requests and responses when Scolah-managed AI is enabled	Global network	Standard Contractual Clauses
DNS provider	Resolving Scolah domain names	IP addresses of clients resolving Scolah domains	Global network	Standard Contractual Clauses
Email delivery provider	Portal invitations, password resets and security notifications	Portal user names and email addresses; message content	Global network	Standard Contractual Clauses

2. Used for Notifications

These subprocessors deliver the text messages, push notifications and email that Scolah sends for your applications. Email is not sent this way when the installation uses its own mail server.

Category	Purpose	Personal data processed	Location	Transfer safeguard
Email delivery provider	Delivering email	Recipient email addresses; subject and message body	Global network	Standard Contractual Clauses
SMS provider	Delivering text messages	Recipient phone numbers; message text	Global network	Standard Contractual Clauses
Mobile push notification service	Delivering push notifications to mobile apps	Device tokens; notification title, text and data	Global network	Standard Contractual Clauses

3. Used Only If You Enable Scolah-Managed AI

This section covers the Compass AI module when it is turned on with the Scolah-managed provider. The default when the module is turned on is “Self-hosted LiteLLM”, which, like “Bring your own key”, does not send requests to Scolah.

Scolah-managed AI adds no subprocessors. Requests go to Scolah’s AI service, which runs them on language and embedding models that Scolah hosts and operates itself (see the cloud infrastructure provider in section 1). No third-party model provider receives AI requests or responses, and Scolah does not use them to train models.

4. Changes to Subprocessors

• At least 30 days before a new subprocessor starts processing personal data, we will update the register and email organisation admins who have subscribed to updates. Where the new subprocessor is in a category not shown here, we will update this page as well.
• You may object on reasonable data-protection grounds within that period, as set out in the DPA.
• To subscribe to updates, email privacy@scolah.com with the subject “Subprocessor updates”.

5. Scolah Corporate Entities

Scolah, Inc. is the contracting entity and processor for the Platform. No other Scolah group company processes Platform customer personal data.