Sub-processors
The sub-processors Skillscan Limited engages to deliver the Skilly platform. Each is contractually bound to equivalent data-protection obligations to those Skillscan undertakes to schools.
Active sub-processors
| Sub-processor | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Supabase Inc. | Primary database — all student reflection text, flags, assignments, audit log, every persistent table | EU — Frankfurt (aws-1-eu-central-1) | Within EEA |
| Vercel Inc. | Application hosting — server-rendered pages, API routes, cron functions. No persistent data. Also provides cookieless, aggregate Web Analytics on the public marketing pages only (visitor counts, page views, referrers) — no cookies, no personal data, never on the signed-in platform. | EU — Frankfurt (fra1, pinned in vercel.json) | EU-U.S. Data Privacy Framework + SCCs 2021 (controller-level — function execution is EU-pinned but contract is US) |
| Anthropic PBC | AI inference — reflection scoring, safeguarding detection, AI-generated reports. Data redacted at our edge for emails / phones / addresses / Eircodes / PPSNs / personal names before transit. Org-level Zero-Retention contract — no input/output retained beyond the response. | United States (default Anthropic endpoint) unless ANTHROPIC_BASE_URL pins an EU endpoint at the deploy | EU-U.S. DPF + SCCs 2021 + Zero-Retention Rider |
| Resend Inc. | Transactional email delivery — wellbeing-flag escalations, password resets, parent digests, classroom invitations, and the marketing demo-request form. Email metadata (recipient, subject) is stored by Resend; we do not store the email body. | United States (api.resend.com) — Resend stores email metadata in the US regardless of the per-domain sending region | EU-U.S. DPF + SCCs 2021 |
| Microsoft Ireland Operations Ltd. | Microsoft 365 SSO — sign-in only when a school enables it. Email + name + Entra Object ID read from the ID token to map to existing Skilly user. No student reflection data ever sent to Microsoft. | Microsoft global identity platform (per the school's own Entra tenancy region) | Within EEA for EU Microsoft tenants; otherwise EU-U.S. DPF + SCCs 2021 |
| Stripe Inc. | School subscription billing — tenant id, school name, billing email, invoice history. No student data, no reflection content, no safeguarding flags. | United States (with EU data centre tier for paid customers) | EU-U.S. DPF + SCCs 2021 |
The live data-residency posture for the running deployment is also surfaced inside the school's admin panel at /admin/gdpr (under Where your data lives) — read at request time so what a DPO sees there is what the production stack actually does, not what this page claims.
Residency position by jurisdiction
Where a jurisdiction we operate in has its own transfer rules, our position and the basis for it are set out below — including anything still unresolved. We would rather a Data Protection Officer read an open question here than discover it later.
United Arab Emirates
Where the data sits. Pupil data is hosted in the EU (Frankfurt) — database and application. This is not UAE residency and we do not describe it as such.
Lawful basis. PDPL Article 23. The UAE Data Office has not published a list of countries with an adequate level of protection, so Skilly does not rely on adequacy. Transfers out of the UAE under UAE Federal Decree-Law No. 45 of 2021 rest on (a) a binding UAE data processing agreement that applies the PDPL's controls to the data and is flowed down to every sub-processor, and (b) express parental consent collected by the school, which names the EU and US processing. Skilly also operates to the GDPR as an Irish processor.
Positions we take.
- Educational records, not health data. Pupil reflections, check-ins and teacher notes are educational records created in delivering the curriculum, under the school's own rules and policies. They are not health data relating to health services, so the localisation rule in Federal Law No. 2 of 2019 (ICT in health fields) does not apply. Skilly is not a health service, and validated wellbeing instruments (WHO-5, SWEMWBS) are off by default in UAE mode.
- AI evaluation of reflection text is processed by Anthropic in the United States, after names, contact details and identifiers are removed, and transactional email is sent by Resend in the United States. Both are covered by the same Article 23 safeguards. See the sub-processor table above for each one's region.
- Abu Dhabi schools go live only after ADEK has given the explicit consent its School Digital Policy requires for a contractor to share personal data inside or outside the UAE.
Open questions we disclose.
- In-country hosting is not a configuration change. Our database provider currently offers no Middle East region, so a UAE-resident deployment would be a separate stack, not a setting.
Marketing-website analytics providers
Separately from the platform sub-processors above, three consent-gated analytics and CRM tools run on our public marketing pages only — never on the signed-in platform, and never touching any school or pupil data. Each loads only after a visitor accepts on the cookie banner, so they process marketing-site visitor data with Skillscan as controller rather than school data under Article 28:
- Google Ireland Ltd. — Google Analytics 4: traffic and campaign attribution on the marketing pages (EU-U.S. DPF + SCCs 2021 for any US transfer).
- Contentsquare SAS (which also owns Hotjar) — session analytics on the marketing pages: how visitors scroll and click, per anonymous session, so we can improve the pages (France/EU headquartered; SCCs 2021 for any non-EEA transfer).
- HubSpot, Inc. — marketing CRM and website tracking on the marketing pages: how prospective schools find us and engage with enquiry forms, so we can respond to and follow up on interest (EU-U.S. DPF + SCCs 2021 for the US transfer).
Cookie names, lifetimes and your choices for both are in the Cookie Policy.
Change notifications
Before we add or replace a sub-processor we will notify each subscribing school at least 30 days in advance and give them an opportunity to object. If a school reasonably objects on data-protection grounds we will either address the objection or allow the school to terminate the subscription with a pro-rata refund.
Where this fits
For the broader picture of who is the data controller, what data we hold, and what rights you have, see our Privacy Policy.
This page is the authoritative list. We do not maintain sub-processor information in any other location. Last updated 14 July 2026.