Classic Test Prep · Trust Center
Subprocessors
Every third party that processes data on our behalf, what reaches it, and whether school student data is ever involved. Each operates under a written agreement and holds its own independent security attestation. We give districts 30 days' notice before adding one that will touch student data.
Last updated November 12, 2026
| Vendor | Purpose | Data | Student data | Location | Trust page |
|---|---|---|---|---|---|
| Render | Application hosting and the managed PostgreSQL database | All application data, encrypted in transit and at rest | Yes | United States (Ohio) | Visit |
| Clerk | Sign-in and account identity (passwords, Google sign-in, multi-factor authentication) | Name, email address, sign-in credentials and session records | Yes | United States | Visit |
| Resend | Transactional email (welcome, support replies, teacher invitations) | Email address and message content | Yes | United States | Visit |
| Cloudflare | Object storage (R2) for lesson video files and encrypted roster files a district chooses to send | Lesson videos (no student data); district roster files only when a district provides them | Yes | United States | Visit |
| Sentry | Application error monitoring | Error reports with personal data stripped (PII sending is disabled) | No | United States | Visit |
| Stripe | Payments for individual (consumer) subscribers only | Payment details for self-pay customers. School accounts never touch Stripe | No | United States | Visit |
| GitHub | Source code hosting and deployment | Source code only, no personal data | No | United States | Visit |
| Google (Tag Manager, Analytics, Ads) | Marketing measurement on public pages and for self-pay customers | Usage data for consumer visitors. Never loaded for school accounts | No | United States | Visit |
Not subprocessors
Our staff use an AI model (Anthropic) to draft marketing copy for our own social media posts. No student or customer data is involved. Our staff publishing tool uses the YouTube API to upload our own instructional videos. Neither service ever receives personal data from the application.
Security questions, questionnaires (HECVAT, CAIQ), vendor SOC 2 reports and policy documents: security@classictestprep.comStudent data requests (access, correction, deletion): security@classictestprep.com. We answer within 3 calendar days.Report a vulnerability: email the security address above. We acknowledge within 1 business day and do not pursue good-faith researchers.