Public · Last updated October 19, 2026
Subprocessor List
Every vendor that touches service data, what it does, where it runs, and the agreement that binds it. Referenced from our Privacy Policy and NDPA exhibits.
| Subprocessor | Service | Purpose | Data categories | Location | Flow-down agreement |
|---|---|---|---|---|---|
| Microsoft Corporation | Azure App Service, Azure Database for PostgreSQL, Azure Blob Storage, Azure Communication Services | Hosting, database, file storage, staff service email delivery (no family messages) | All service data (encrypted in transit + at rest) | United States (Central US region) | Microsoft Products and Services DPA |
| Google LLC | Vertex AI (Gemini) | Staff-requested family message drafts, monthly attendance summaries, and case-history summaries | Required scope: only the context needed for the staff request. Attend must enforce minimization and permissions before handling real district data; no training on customer data. | United States (us-central1, Iowa — pinned in configuration) | Google Cloud Data Processing Addendum |
| Ednition, Inc. | RosterStream (Core Rostering, SSO Connect) | District-approved SIS data and single sign-on connections | Roster/directory: student and staff names, school emails, external IDs, staff roles, grade level, school, course and section enrollments. Daily attendance and absence codes. Guardian contact fields only where shared by the district. Course grades and credits only when the district enables the counselor academic view. All arrive through the approved Ednition connection. Never staff-created absence context, contact/home-visit logs, plans, meeting or restricted notes, message/summary drafts, report worksheets, Agenteach audit trails, or AI requests/outputs. |
United States (Amazon Web Services US regions; tenancy pinned to the US) | Ednition is bound by its agreement with Agenteach to process only as instructed, use data only to provide the service, prohibit AI training, and keep data confidential. It must delete data within 60 days of termination and promptly notify Agenteach in writing of a breach or potential breach. Its Privacy Statement states no sale, advertising, or profiling. SOC 2 Type 2 attested; ISO/IEC 27001:2022 certified; annual penetration testing. Reports: trust.ednition.com. |
Notes
- No analytics, advertising, error-tracking, or session-replay vendors are permitted in Attend. The July 2026 code audit covered the earlier implementation only; this restriction must be verified for Attend before it handles real district data.
- Ednition, Inc. was added on September 4, 2026 under the change process below as our district-integration partner. Ednition processes district-approved data under Agenteach's direction, including attendance and district-enabled counselor grades through the approved Ednition connection, and is bound by its agreement with Agenteach to the obligations described above; a full description of the partnership, the data boundary, Ednition's assurance reports, and the framework mapping is in Privacy Policy §7.
- October 19, 2026: aligned this list with Agenteach Attend and Privacy Policy v2.0. Removed the former Google Classroom/Gmail integration and optional LMS path because Attend does not sync coursework or send family messages. District Google/Microsoft sign-in remains supported. Azure staff service email remains separate from family outreach. No privacy or security commitment was weakened.
- Change process: LEAs under agreement receive advance notice of any subprocessor addition or change; new subprocessors are bound to equivalent privacy, security, deletion, and breach-response terms before receiving any data.