Sub-processors

Last updated: May 25, 2026

Version: 1.1

This page lists the third parties (sub-processors) that better-ed uses to deliver our voice-enabled AI assessment platform. It is incorporated by reference into our Privacy Policy, our Terms of Service, and our institutional Data Processing Agreement.

A sub-processor is a third-party service provider that processes personal data on our behalf in order to deliver the better-ed Service. We perform due diligence on each sub-processor before engaging them and require each to provide contractual protections appropriate to the data they handle, including the EU Standard Contractual Clauses where data is transferred outside the EEA.

Notice of changes. We commit to giving institutional customers at least 30 days’ advance notice before adding or replacing a sub-processor that processes pupil or teacher personal data. Subscribe to update notifications by emailing privacy@better-ed.ai with the subject “Subscribe to sub-processor updates.”

Sub-processors that process pupil or teacher personal data

These sub-processors are engaged in delivering the school-deployed assessment Service. The school, municipality, or institution is the data controller for pupil and teacher data; Better Oy (for EU/EEA institutions) or Predictive Systems, Inc. (for US and Philippines institutions) acts as processor; the entities below act as sub-processors.

Sub-processor	Purpose	Region of processing	Data Processing Agreement
Google LLC (Google Cloud Platform, Vertex AI Gemini, Speech-to-Text)	Hosting for EU/EEA tenants; AI inference and speech-to-text for the assessment Service	EU: `europe-north1` (Finland) US: US regions	Cloud Data Processing Addendum Google’s sub-processor list
Microsoft Corporation (Microsoft Azure, Azure OpenAI Service)	Hosting for US and Philippines tenants; AI inference for the assessment Service. Azure OpenAI does not use prompts or completions to train foundation models.	US East	Microsoft Products and Services DPA Microsoft’s sub-processor list
Groq, Inc.	Low-latency AI inference for the assessment Service	Region pinning under confirmation	Groq Data Processing Addendum Services Agreement

Sub-processors used on the marketing site and in business operations

These sub-processors do not process pupil personal data. They support our marketing site, sales activities, and business operations. Predictive Systems, Inc. is the data controller for the activities below.

Sub-processor	Purpose	Region of processing	Data Processing Agreement
Google LLC (Google Analytics)	Web analytics on the marketing site only. Consent-gated via the cookie banner. Not active in the pupil-facing assessment Service.	US and EU	Google Ads Data Processing Terms (Google Analytics is included under the Google Ads Data Processing Terms; the Cloud DPA linked above covers Google Cloud services for the assessment Service.)
HubSpot, Inc.	Customer relationship management for B2B sales and marketing contacts. Does not process pupil personal data.	US and EU	HubSpot Data Processing Agreement HubSpot’s sub-processor list
Tally.so BV	Feedback and survey forms. Anonymous unless the respondent voluntarily identifies themselves.	EU (Belgium)	Tally Data Processing Agreement

Hosting and infrastructure architecture

We operate region-isolated infrastructure with separate administration consoles per region:

EU/EEA tenants: Google Cloud Platform, region europe-north1 (Finland). EU pupil and teacher data is not replicated outside the EEA.
US and Philippines tenants: Microsoft Azure, US East. Azure OpenAI inference runs in the same region.

Vendor due diligence

Before engaging a sub-processor we assess:

The categories of personal data the sub-processor will process;
The sub-processor’s data-protection certifications and audit reports (e.g. ISO/IEC 27001, SOC 2);
The sub-processor’s contractual commitments under Article 28 GDPR (or equivalent), including its own published sub-processor list and change-notice mechanism;
The legal mechanism for any cross-border transfers (Standard Contractual Clauses, adequacy, or other approved instrument);
The sub-processor’s incident-response and breach-notification commitments;
The minimum data necessary to deliver the service.

We review each sub-processor at least annually and on any material change in the sub-processor’s service or in our use of it.