Sub-Processors
Last updated: 4 July 2026
This page lists the third-party service providers that Class Diagnostix Ltd uses to provide, host, secure, support and administer the Class Diagnostix service.
For school-uploaded pupil and assessment data, schools and trusts are usually the data controller and Class Diagnostix Ltd is usually the data processor. Where a third-party provider processes that data for us, that provider is treated as a sub-processor.
This list should be reviewed before publication and whenever a material supplier is added or replaced.
Current Production Sub-Processors
| Provider | Purpose | Personal data involved | Location / transfer notes | Status |
|---|---|---|---|---|
| Railway Corp. | Application hosting, web application runtime, worker runtime, PostgreSQL database and Redis task queue/cache services. | Account data, school-uploaded assessment data, generated reports, files, logs and technical metadata. | Production services are configured in Railway's EU West / Amsterdam region. | Production application infrastructure. |
| Amazon Web Services, Inc. / Amazon Web Services EMEA SARL | Transactional email delivery using Amazon Simple Email Service (SES), including contact/support notifications, account setup emails and password reset emails. | Names, email addresses, school/organisation details and minimal message/notification content. Uploaded spreadsheets, reports and pupil-level data are not sent by email. | Amazon SES is configured in the Europe (London) region for production transactional email. | Production transactional email provider. |
| Zoho Corporation / Zoho Mail | Business email mailbox service for receiving and managing messages sent to Class Diagnostix email addresses. | Names, email addresses, organisation details and message content sent by email. Users should not send pupil data, assessment uploads, generated reports or sensitive personal data by email unless a specific secure process has been agreed. | Zoho Mail is used for business mailbox/email inbox services. Data location is United States of America. | Production business email mailbox provider. |
| Microsoft Azure | Encrypted production backup storage using Azure Blob Storage. | Encrypted backup copies of production app data, which may include account data, school-uploaded assessment data, generated reports, logs and support/contact records. | Azure Blob Storage is configured in UK South. Backup files are encrypted before upload and retained for up to 28 days. | Production backup storage. |
Services Not Currently Used For Production App Data
| Service type | Current position |
|---|---|
| External PDF or rendering services | Not currently used. PDF/report rendering is carried out by Class Diagnostix using server-side application code, local Python PDF libraries and local Playwright/Chromium rendering within the app hosting environment. |
| AI or automated content-generation APIs | Not currently used for processing school-uploaded pupil assessment data. |
| Analytics providers | Not currently listed as production sub-processors. If analytics are added, they should be consent-controlled where required and added to this page before use. |
| Payment processors | Not currently listed as production sub-processors. If online card or subscription payments are added, the payment provider should be added to this page before use. |
How We Manage Sub-Processors
We aim to use service providers that offer appropriate security, confidentiality and data protection commitments. Where a provider processes personal data for us as a processor or sub-processor, we will put appropriate contractual protections in place.
We remain responsible to our customers for the performance of our sub-processors where required by our Data Processing Agreement and applicable data protection law.
We will update this page when we add or replace a material sub-processor. Customers who need direct notice of material sub-processor changes should contact us so this can be agreed in the relevant order form or Data Processing Agreement.
Contact
Questions about sub-processors should be sent to hello@classdiagnostix.com.
Related documents: Privacy Policy, Data Processing Agreement, and Cookie Policy.
Registered office: Class Diagnostix Ltd, 124 City Road, London, EC1V 2NX, UK.