Subprocessors
Vendors that process or host school data on behalf of PassPlace. District counsel typically requires DPAs with PassPlace and with primary infrastructure vendors.
| Vendor | Function | Data | Notes |
|---|---|---|---|
| Supabase, Inc. | Managed PostgreSQL, authentication, file storage, realtime | Student/staff education records, pass history, audit logs, school assets | Region selected at project creation (e.g. US East). |
| Vercel, Inc. | Application hosting (Next.js), serverless functions | Request metadata and application logs (must not contain student PII) | US-based hosting. Secrets stored server-side only. |
| Browser push services | Web Push for installed PWA when staff opt in | Device push endpoint; alert text composed by school staff | Apple Push Notification service, Google FCM, or Mozilla autopush — invoked by the user’s browser only when phone alerts are enabled. |
Supabase and Vercel publish SOC 2 Type II reports and security documentation on their trust pages. Web Push is optional and only active when a staff member enables phone alerts on an installed PWA.