Scholar Current
Math and Physics Practice / Book Access / Teacher Tools
Scholar Current
Vendor And Subprocessor Inventory
Effective date: June 8, 2026. This inventory documents known vendors and
subprocessors that may support Scholar Current hosting, security, email delivery, repository storage,
payments, backups, analytics, and operational support.
1. How To Use This Inventory
This page is an operational compliance inventory, not a final legal contract. It is designed to help administrators, schools, and reviewers identify the services that may process, store, secure, transmit, or support personal data, student records, class data, account data, or support information.
Review note: Items marked "verify in dashboard or contract" require a manual check in the
vendor account, contract, DPA, data-processing terms, or production dashboard before a school contract or
formal privacy review relies on the value.
For database encryption, backup retention, restore access, and production administrator access evidence, see the Hosting Security And Backup Evidence Checklist.
Data categories covered
Account data, school account roles, school-owned purchases, pooled-seat records, class rosters, assignment records, gradebook data, student work, issue reports, privacy requests, admin audit records, and section-builder content.
Current code-confirmed vendors
Render/PostgreSQL hosting, Cloudflare-hosted web access/pages, Resend email delivery, and GitHub repository storage are reflected in code, configuration, deployment notes, or production URLs.
Not confirmed in code
Payment processor, analytics, and error-monitoring vendors are not confirmed by the current repository scan and should remain disabled/unlisted until configured.
2. Subprocessor And Vendor Table
| Vendor | Purpose | Data That May Be Involved | Role | Region / Location | Contract / DPA Status | Backup / Retention Notes | Status / Follow-Up |
|---|---|---|---|---|---|---|---|
| Render | Production API hosting and managed PostgreSQL database hosting for
api.scholarcurrent.app.
|
Account records, hashed passwords, sessions, school account roles, school-owned purchase and pooled-seat records, class rosters, assignments, gradebook/attempt data, access records, audit logs, issue reports, privacy requests, section-builder records, and operational metadata. | Hosting provider / infrastructure subprocessor. | Production database region observed as Virginia in Render dashboard screenshot. Confirm service and backup regions in Render dashboard. | VerifyConfirm active plan terms, DPA or data-processing terms, support access terms, and database/security commitments in Render account/contracts. | VerifyConfirm backup encryption, backup retention, restore process, and who can access snapshots/backups in Render. | Active production vendor. Requires dashboard/contract evidence for school-facing review. |
| Render PostgreSQL | Managed relational database used by the API through DATABASE_URL. |
Same production database categories listed above, including student education records, school purchase/access records, pooled-seat allocation records, renewal metadata, and compliance/audit records. | Database subprocessor through Render. | Virginia observed for current database. Confirm exact database and backup region. | VerifyCovered by Render terms if database is provisioned through Render; confirm DPA and service-specific database terms. | VerifyConfirm at-rest encryption, backup encryption, backup retention, PITR availability if enabled, and restore permissions. | Active production database. Also tracked by the separate hosting-side encryption/backups todo item. |
| Cloudflare | Cloudflare Access / Zero Trust protection, DNS/routing/security, and Cloudflare Pages-hosted frontend routes or previews. | Access login emails, one-time access flow metadata, IP addresses, request metadata, frontend static assets, and protected-route access logs. Cloudflare should not store application passwords. | Security/access/CDN provider and potential subprocessor. | Global edge network. Confirm account region, log retention, and any data-localization settings. | VerifyConfirm Cloudflare DPA/data-processing terms, Access log retention, Zero Trust application policies, and administrator access controls. | VerifyConfirm Cloudflare log retention and whether Access logs are exported or retained outside Cloudflare. | Active production access/security vendor. |
| Resend | Transactional email delivery for verification, password reset, account recovery alerts, privacy alerts, and student/teacher notification emails. | Email addresses, display names, email content, verification/reset links, temporary password notices when issued by a teacher, account recovery context, IP/user-agent details included in alert emails. | Email delivery subprocessor. | VerifyConfirm processing and storage regions in Resend account/terms. | VerifyConfirm Resend DPA/data-processing terms, message logging policy, retention controls, and suppression-list handling. | VerifyConfirm email event/log retention and whether message bodies are retained. | Code-confirmed through RESEND_API_KEY and mailer configuration. |
| GitHub | Private source-code repository hosting, deployment history, issue/code review context if used, and possible storage of seeded/private book content or configuration examples. | Source code, private content files, deployment scripts, configuration examples. Personal/student data should not be committed; if accidentally committed, treat as an incident/remediation item. | Repository/storage vendor; potential subprocessor if personal data is stored in repos or logs. | VerifyGlobal/US-oriented service; confirm account/org terms and data residency options if needed. | VerifyConfirm GitHub terms/DPA if repository content can include personal data or student records. | VerifyConfirm repository retention, deleted secret/data remediation, audit logs, and access review process. | Active private repository vendor. Keep production secrets and student data out of git. |
| Cloudflare Pages | Static frontend hosting and preview deployment for production and testing domains. | Static site files, client-side code, public content, deployment metadata, request metadata. Should not contain private student data in static files. | Frontend hosting/CDN provider through Cloudflare. | Global edge network. Confirm deployment/log retention and data location controls. | VerifyCovered by Cloudflare terms/DPA if enabled; confirm Pages-specific logs and build retention. | VerifyConfirm build artifact retention and access to preview deployments. | Active frontend hosting path for Scholar Current pages. |
| Payment processor | Future payment, subscription, invoice, or checkout handling if monetized payments are enabled. | Payment account details, billing contact, teacher class order metadata, school-owned purchase metadata, pooled student-seat quantities, yearly renewal status, invoice/checkout identifiers, and tax/refund records. Card data should be handled by the payment processor and not stored directly by Scholar Current. | Payment processor / independent controller or subprocessor depending on contract. | Not configuredNo payment provider was confirmed in the current code scan. | Select provider before accepting payments; document PCI scope, DPA/terms, webhook retention, tax data, refunds, and chargeback data. | Document processor retention and webhook/event retention when configured. | Pending. Add provider before launch of paid checkout. |
| Analytics / error monitoring | Future product analytics, crash reporting, error telemetry, or performance monitoring if enabled. | Could include IP address, user agent, page route, account identifiers, error messages, and context. Avoid sending student free-response text or gradebook content. | Analytics/error-monitoring vendor if configured. | Not configuredNo analytics or error-monitoring provider was confirmed in the current code scan. | Select provider only with privacy controls, DPA, data minimization, retention limits, and student-data redaction. | Set short retention and disable unnecessary session replay or sensitive field capture. | Pending. Do not enable until minimization/redaction requirements are documented. |
| Backup systems | Database backups, deployment/build backups, repository history, and any exported compliance files. | Potentially all production data if database backups are included; repository backups should not contain student data. | Backup/storage subprocessor depending on where backups are kept. | VerifyLikely Render database backups and GitHub repository history; confirm any additional local/cloud backup tools. | VerifyDocument each backup vendor, contract, encryption, restore access, retention, deletion, and incident response process. | Needs explicit backup-retention evidence. Avoid unmanaged local exports of student data. | Partially known. Covered further by the separate encryption/backups todo item. |
3. Minimum Review Checklist Before School Use
- Confirm which vendors are active in production and remove any vendors that are no longer used.
- Save evidence of the active plan, DPA/data-processing terms, region, backup retention, and support-access terms for each active subprocessor.
- Confirm no payment, analytics, or error-monitoring provider is enabled unless it has been added to this inventory.
- Confirm production secrets are stored in the hosting/provider dashboard and not in source control.
- Review administrator access to Render, Cloudflare, Resend, GitHub, and any backup/export locations at least once per term.
- Update this inventory before adding a new vendor that will process student records or personal data.
4. Update And Contact Process
For questions about this inventory or a school-specific vendor review, contact [email protected]. Material vendor changes should be reflected here and reviewed with any affected school, teacher, parent/guardian, or eligible student process where required.
This page should be reviewed with qualified counsel before being used as final legal advice or incorporated into a signed school agreement.