Sub-Processor List

1. Overview

This page provides a comprehensive list of all third-party sub-processors that may process personal data on behalf of institutional customers using the Ludwitt Adaptive Learning Platform. As a data processor, Ludwitt engages these sub-processors to deliver specific aspects of the platform's functionality. Each sub-processor has been evaluated for security, privacy, and compliance with applicable data protection regulations including GDPR, FERPA, and COPPA.

This list is maintained as part of Ludwitt's transparency commitments under our Data Processing Agreement (DPA) and is updated whenever sub-processor changes occur.

2. Notification Policy

3. Current Sub-Processors

The following table lists all sub-processors currently engaged by Ludwitt, along with the nature of processing, data categories, and compliance status.

4. Data Processing Details

The following provides additional detail on the data flows, restrictions, and retention practices for each sub-processor.

Google Cloud / Firebase

Firebase serves as Ludwitt's primary infrastructure provider. User account data (email, display name, authentication tokens), learning progress, and application state are stored in Firebase Firestore. User-uploaded files are stored in Firebase Storage. All data resides in the us-central1 region. Firebase Authentication manages user identity and session tokens. Data is encrypted at rest (AES-256) and in transit (TLS 1.2+). Retention follows Ludwitt's Data Retention Policy — data is deleted within 30 days of account termination or upon institutional request.

Vercel

Vercel hosts the Ludwitt web application and executes serverless API functions. Vercel processes HTTP request metadata (IP addresses, user agents) for routing and caching purposes. Vercel does not have direct access to Firestore data or user credentials. Serverless function logs are retained for 30 days. Vercel's CDN caches only static assets — no user-specific data is cached at the edge.

Anthropic

Anthropic's Claude AI API is used for grading student answers, generating explanations, and providing adaptive feedback. Only educational content (questions, student answers, subject context) is sent to the API. No personally identifiable information (PII) — including names, emails, student IDs, or institutional identifiers — is transmitted to Anthropic. API requests are stateless; Anthropic does not retain input data for model training under our commercial agreement. All transmissions use TLS 1.2+ encryption.

Stripe

Stripe processes payment transactions for institutional billing and individual credit purchases. Stripe receives only payment-related information (card details, billing addresses, transaction amounts). No student data, learning progress, or educational records are shared with Stripe. Stripe is PCI DSS Level 1 certified. Payment card data is tokenized and never stored on Ludwitt's servers. For institutional customers with purchase orders, Stripe may not be involved in the transaction flow.

Daily.co

Daily.co provides real-time video and audio communication for study room sessions. Audio and video streams are processed in real time and are ephemeral — they are not recorded or stored by either Ludwitt or Daily.co. Session metadata (room IDs, participant counts, connection quality metrics) is retained for 30 days for operational monitoring. No student names or educational data are transmitted to Daily.co beyond session participation.

Sentry

Sentry provides application error monitoring and performance tracking. Sentry receives error metadata, stack traces, browser/device information, and request URLs when application errors occur. No PII is transmitted to Sentry. Ludwitt's Sentry integration is configured with data scrubbing rules to strip any potentially sensitive information before transmission. Error data is retained in Sentry for 90 days.

5. Changes & Updates

Ludwitt maintains this sub-processor list as a living document. The following process governs changes:

• New Sub-Processor: Institutional customers receive written notice at least 30 calendar days before any new sub-processor begins processing personal data.
• Material Changes: Changes to the scope of processing, data categories, or geographic location of an existing sub-processor trigger the same 30-day notice period.
• Objection Rights: Per the DPA, institutions may object to a new or changed sub-processor within the notice period. Ludwitt will make reasonable efforts to address objections, including offering alternative configurations that avoid the objected-to sub-processor.
• Emergency Changes: In rare cases where an immediate sub-processor change is required for security or legal compliance, Ludwitt will notify institutions as soon as practicable and provide a full explanation.
• Page Updates: This page is updated within 5 business days of any sub-processor change being finalized.

6. Related Documents

For additional context on how Ludwitt handles data processing and privacy, please refer to the following documents:

• Data Processing Agreement (DPA) — Full data processing terms, including security measures, breach notification, and audit rights
• Privacy Policy — Comprehensive privacy practices for all users
• AI Transparency Statement — How AI is used in the platform, data flows, and safeguards
• FERPA Data Flow Documentation — Detailed data flow diagrams showing how student educational records are processed
• Data Retention Policy — Retention periods and deletion procedures for all data categories
• Security Overview — Technical security measures, encryption, and infrastructure details