Sub-Processor List — ThinkKits Security

Third-Party Sub-Processors

ThinkKits works with carefully vetted sub-processors to deliver our education data platform.

Data Processing Agreement status: under audit (April 2026). We are currently reviewing the DPA status of each sub-processor (executed custom DPA vs. clickthrough DPA accepted at signup vs. pending). Current per-vendor DPA status is not published here until that audit is complete. Procurement teams who need current DPA status for vendor vetting should email legal@thinkkits.com — we will respond within three business days.

Service Name	Purpose	Data Processed	Data Location
Clerk clerk.com	User authentication and identity management	User Identity Email Addresses Login History	🇺🇸 United States
Stripe stripe.com	Payment processing and billing management	Payment Data Billing Info Transaction History	🇺🇸 United States
Supabase supabase.com	Database hosting and user session management	User Profiles Session Data App Settings	🇺🇸 United States
Pinecone pinecone.io	Vector database for semantic search and AI features	Search Embeddings Query Data Content Vectors	🇺🇸 United States
Neo4j (Railway) neo4j.com	Knowledge graph database for education data relationships	School Data District Data Funding Records	🇺🇸 United States
Sentry sentry.io	Error monitoring and performance tracking	Error Logs Performance Data Debug Info	🇺🇸 United States
HubSpot hubspot.com	Customer relationship management and marketing automation	Lead Contact Data Marketing Analytics Communication History	🇺🇸 United States
Shopify shopify.com	E-commerce platform for curriculum kit sales	Order Data Shipping Info Inventory Data	🇺🇸 US / 🇨🇦 Canada
UptimeRobot uptimerobot.com	Website and API uptime monitoring	Availability Data Response Times Alert History	🇪🇺 European Union
Railway railway.app	Cloud hosting and application runtime environment	Application Runtime System Logs Deployment Data	🇺🇸 United States
Microsoft 365 microsoft.com	Email communications and productivity services	Email Communications Calendar Data Document Storage	🇺🇸 United States

Data Protection Standards

All sub-processors are required to meet or exceed ThinkKits' data protection standards:

Data Processing Agreements (DPAs) — Contractual obligations for data handling
Security Certifications — SOC 2 Aligned, ISO 27001, or equivalent standards
Encryption Requirements — Data encrypted in transit and at rest
Access Controls — Principle of least privilege for data access
Incident Response — 24-hour breach notification requirements
Regular Audits — Annual security assessments and compliance reviews

Change Management Process

ThinkKits follows a strict process for sub-processor changes:

30-Day Notice — All customers notified before adding new sub-processors
DPA Requirements — New sub-processors must sign DPAs before processing data
Security Assessment — Comprehensive security review for all new vendors
Customer Objection Rights — Enterprise customers may object to new sub-processors
Documentation Updates — This list updated within 5 business days of changes

GDPR Compliance

For EU customers, this sub-processor list satisfies Article 28(2) requirements. All sub-processors processing EU personal data have appropriate Standard Contractual Clauses (SCCs) or adequacy decisions in place.

Contact & Requests

For questions about our sub-processors or to request DPA copies:

Privacy Team: privacy@thinkkits.com
Security Team: security@thinkkits.com
DPA Requests: legal@thinkkits.com