Sub-processors

Back to home

This page lists the third-party services that process Brevlex customer or end-user data on our behalf. It is the single source of truth for our sub-processor list and is updated whenever a sub-processor is added or removed. District procurement teams can link directly to this page from a signed DPA.

If you need a written notice when this list changes, contact support@brevlex.com.

Current sub-processors

Anthropic, PBC (Claude API)

Purpose: AI provider — example sentences, mnemonics, word associations, translations, AI Learning Packs and their content-safety check, and reading interests a user types
Data category: The word with its definition and part of speech; the learner’s selected interests, a learning-goal style hint and sentence-style settings; a class’s grade level for student sentences; text to translate and the target language; and text a user types into an AI-powered field (such as an interest description or a Learning Pack request), sent as written. No email, name, or account ID.
Location: Anthropic, PBC is a US company; Anthropic sets the processing region

Amazon Web Services — Bedrock

Purpose: Alternative AI provider: study features while it is the switched-on provider, and Learning Packs only when no Anthropic key is configured
Data category: The same data as Anthropic, for the features using it. No email, name, or account ID.
Location: United States (AWS us-east-1 by default)

Gutendex (gutendex.com)

Purpose: Public catalogue of Project Gutenberg books, searched to find a public-domain source for a themed Learning Pack
Data category: A search phrase taken from the pack request (request phrasing removed, at most 200 characters), sent from our server. No email, name, or account ID.
Location: Public web service (location not published)

Stripe, Inc.

Purpose: Payment processor. Paid plans are not on sale right now; Stripe holds the Customer records that earlier checkouts created
Data category: Customer email, an internal Brevlex user-ID reference, and purchase/subscription metadata (plan, subscription status, renewal, and refund/dispute status). Card details are entered on Stripe-hosted Checkout and the Customer Portal and never reach Brevlex servers — Brevlex stores no card data.
Location: United States (Stripe, Inc.)

Google OAuth

Purpose: Optional "Sign in with Google" identity provider
Data category: Name, email, and Google account ID at sign-in (only if user selects Google sign-in)
Location: United States (global service)

PostHog

Purpose: Product analytics — page views and study events, only for visitors who allow usage stats
Data category: Pseudonymous user ID and event metadata, including the plan chosen at checkout and, from our server, that a plan started. No IP address is stored and no location is looked up. Nothing is sent without the visitor’s yes, and nothing from student (kid-session) routes.
Location: United States (app.posthog.com, US cloud)

Sentry

Purpose: Error and exception tracking (client, server, edge) — not currently active
Data category: Not currently active — no Sentry DSN is configured in production, so nothing is transmitted to Sentry. If re-enabled, it would receive stack traces, request context, and the signed-in user ID and email.
Location: United States (sentry.io US cloud)

Brevo (Sendinblue)

Purpose: Email — verification, password reset, welcome, class invites, study reminders and the weekly progress summary (Brevo API, with Brevo's own SMTP relay as fallback)
Data category: Recipient email, name, token URLs, the requesting IP address in security-alert emails and, for reminders and summaries, study figures (such as words studied, streak and accuracy)
Location: European Union (France)

Free Dictionary API (dictionaryapi.dev)

Purpose: Looks up definitions for a word a user or teacher adds, and for words proposed for a Learning Pack or a class word list
Data category: The single word being looked up, sent from our server. No email, name, or account ID.
Location: Public web service (location not published)

Wiktionary (Wikimedia Foundation)

Purpose: Fallback definition lookup when the Free Dictionary API has no entry or cannot be reached
Data category: The single word being looked up, sent from our server. No email, name, or account ID.
Location: United States (Wikimedia Foundation)

Have I Been Pwned (Pwned Passwords)

Purpose: Checks whether a new password appears in known data breaches
Data category: The first 5 characters of a SHA-1 hash of the password (k-anonymity), sent from our server. Never the password, email, name, or account ID.
Location: Operated by Have I Been Pwned (Australia); served through Cloudflare's global network

Let's Encrypt (ISRG)

Purpose: TLS certificate issuance (ACME)
Data category: Domain names only
Location: United States

DigitalOcean

Purpose: VPS hosting (one server running the application, PostgreSQL and Redis)
Data category: All application data at rest and in transit
Location: United States (San Francisco, SFO2 region)

Name	Purpose	Data category	Location
Anthropic, PBC (Claude API)	AI provider — example sentences, mnemonics, word associations, translations, AI Learning Packs and their content-safety check, and reading interests a user types	The word with its definition and part of speech; the learner’s selected interests, a learning-goal style hint and sentence-style settings; a class’s grade level for student sentences; text to translate and the target language; and text a user types into an AI-powered field (such as an interest description or a Learning Pack request), sent as written. No email, name, or account ID.	Anthropic, PBC is a US company; Anthropic sets the processing region
Amazon Web Services — Bedrock	Alternative AI provider: study features while it is the switched-on provider, and Learning Packs only when no Anthropic key is configured	The same data as Anthropic, for the features using it. No email, name, or account ID.	United States (AWS us-east-1 by default)
Gutendex (gutendex.com)	Public catalogue of Project Gutenberg books, searched to find a public-domain source for a themed Learning Pack	A search phrase taken from the pack request (request phrasing removed, at most 200 characters), sent from our server. No email, name, or account ID.	Public web service (location not published)
Stripe, Inc.	Payment processor. Paid plans are not on sale right now; Stripe holds the Customer records that earlier checkouts created	Customer email, an internal Brevlex user-ID reference, and purchase/subscription metadata (plan, subscription status, renewal, and refund/dispute status). Card details are entered on Stripe-hosted Checkout and the Customer Portal and never reach Brevlex servers — Brevlex stores no card data.	United States (Stripe, Inc.)
Google OAuth	Optional "Sign in with Google" identity provider	Name, email, and Google account ID at sign-in (only if user selects Google sign-in)	United States (global service)
PostHog	Product analytics — page views and study events, only for visitors who allow usage stats	Pseudonymous user ID and event metadata, including the plan chosen at checkout and, from our server, that a plan started. No IP address is stored and no location is looked up. Nothing is sent without the visitor’s yes, and nothing from student (kid-session) routes.	United States (app.posthog.com, US cloud)
Sentry	Error and exception tracking (client, server, edge) — not currently active	Not currently active — no Sentry DSN is configured in production, so nothing is transmitted to Sentry. If re-enabled, it would receive stack traces, request context, and the signed-in user ID and email.	United States (sentry.io US cloud)
Brevo (Sendinblue)	Email — verification, password reset, welcome, class invites, study reminders and the weekly progress summary (Brevo API, with Brevo's own SMTP relay as fallback)	Recipient email, name, token URLs, the requesting IP address in security-alert emails and, for reminders and summaries, study figures (such as words studied, streak and accuracy)	European Union (France)
Free Dictionary API (dictionaryapi.dev)	Looks up definitions for a word a user or teacher adds, and for words proposed for a Learning Pack or a class word list	The single word being looked up, sent from our server. No email, name, or account ID.	Public web service (location not published)
Wiktionary (Wikimedia Foundation)	Fallback definition lookup when the Free Dictionary API has no entry or cannot be reached	The single word being looked up, sent from our server. No email, name, or account ID.	United States (Wikimedia Foundation)
Have I Been Pwned (Pwned Passwords)	Checks whether a new password appears in known data breaches	The first 5 characters of a SHA-1 hash of the password (k-anonymity), sent from our server. Never the password, email, name, or account ID.	Operated by Have I Been Pwned (Australia); served through Cloudflare's global network
Let's Encrypt (ISRG)	TLS certificate issuance (ACME)	Domain names only	United States
DigitalOcean	VPS hosting (one server running the application, PostgreSQL and Redis)	All application data at rest and in transit	United States (San Francisco, SFO2 region)

Planned / Pilot Sub-processors (not yet active)

The following sub-processors are not currently processing production traffic. They are forward-looking commitments for district SSO and roster-sync integrations and will only be enabled per-district during onboarding once a signed DPA is in place.

Microsoft Azure AD — SSO for districts using Microsoft 365. Pilot only — activated per-district during onboarding.
Clever — SIS roster sync. Pilot only — activated per-district during onboarding.
ClassLink — SIS roster sync. Pilot only — activated per-district during onboarding.

Encryption posture

We document our encryption configuration honestly so district procurement teams can evaluate it without ambiguity. The summary below reflects the production deployment as of the date above; the full attestation covers verification commands, compensating controls, and remediation plans.

In transit: TLS 1.2+ on all surfaces, terminated at Caddy with Let's Encrypt certificates.
Passwords: bcrypt (12 rounds for adult accounts).
2FA secrets: AES-256-GCM at the application layer, key held in a server-side environment variable.
PostgreSQL at rest: data lives on the DigitalOcean droplet's local disk (ext4), which is not encrypted at rest by default. No Postgres TDE or whole-database encryption is enabled.
DigitalOcean Block Storage Volumes: provide AES-256 encryption at rest in the storage cluster. Brevlex does not currently use a Block Storage Volume for the database; migrating to one is on the remediation list.
Database backups: pg_dump output is stored on the same droplet disk and is not GPG-wrapped today. Encrypting backup output and moving to an encrypted off-site destination is planned.

The full write-up — production storage topology, verification commands, compliance positioning, and remediation priority order — lives in our internal Encryption-at-Rest Attestation document. District security teams can request the current copy from support@brevlex.com.

Infrastructure not listed here

PostgreSQL and Redis run on the same DigitalOcean VPS that hosts the application — they are not separate third-party services. We do not use managed database services (RDS, ElastiCache, Upstash) or third-party CDN proxies on the apex domain.