Sub-processor List
Third parties that process customer data, and what they touch.
Sub-processor List is not yet published.
The text below is a draft awaiting legal review. It is not in force, no part of it creates any obligation or right, and nothing on this page should be relied on. Passages marked [TO BE CONFIRMED] are values that have deliberately been left blank rather than guessed.
Catomni Studio handles information about children, so these documents go to a lawyer before they take effect rather than being generated and published.
If you need answers about how your data is handled before these are published, contact your studio directly.
Draft revised: 2026-08-17
Notes for legal review
Open questions and drafting assumptions in this document. These notes are removed when the document goes into force.
- DRAFT for review. Compiled from the codebase — every row corresponds to a binding, SDK or API client that exists in the repository. It is accurate as of the revision date and should be re-derived whenever a dependency is added.
- All five sub-processors are US-established. That is what makes the transfer mechanism question in the DPA and Privacy Policy load-bearing for any UK/EU studio.
- A mechanism for notifying customers of changes to this list needs to exist before the DPA's notice commitment is real. Marked below.
- Sentry receives diagnostic data that may incidentally contain identifiers present in a failing request. This is disclosed rather than glossed, because it is the row most likely to be missed in a procurement review and the hardest to characterise precisely.
Current sub-processors
These are the third parties that process Customer Data on our behalf in order to run Catomni Studio. Each is engaged under a written contract with data protection obligations no less protective than those we owe you, as required by the Data Processing Addendum.
| Sub-processor | What it does for us | What it processes | Location |
|---|---|---|---|
| Cloudflare, Inc. | The platform itself — application compute, the primary database, file and image storage, outbound email delivery, bot protection on public forms, and network security and content delivery. | All Customer Data, including student and family records, uploaded photographs and files, and email content. | United States, with processing at global edge locations. |
| Stripe, Inc. | Payment processing for tuition collected by studios, and billing for the Catomni platform subscription. | Payer name and contact details, billing identifiers, transaction and payout records, subscription and invoice status. Card details go directly to Stripe and never reach us. | United States. |
| Twilio Inc. | Delivery of text messages that a studio chooses to send. | Recipient telephone number, message content, and delivery status. | United States. |
| Functional Software, Inc. (Sentry) | Error and exception monitoring, so we can find and fix faults. | Technical diagnostic data — error messages, stack traces, request metadata and browser information. It may incidentally include identifiers present in the request that failed. It is not used as a store of customer records. | United States. |
| Google LLC | Optional "Sign in with Google" authentication. | The email address and Google account identifier of a person choosing to sign in that way. No student or family records are sent to Google. | United States. |
What is not on this list
There are no advertising networks, no analytics or product-telemetry providers, no data brokers, no marketing automation platforms and no AI or machine-learning vendors processing Customer Data. If that changes, this list changes first.
Changes to this list
We will notify customers before a new sub-processor begins processing Customer Data, and you may object on reasonable data protection grounds, as set out in section 5 of the Data Processing Addendum. Notifications will be sent by [TO BE CONFIRMED: sub-processor change notification mechanism — e.g. email to billing contacts, or a subscribable feed].
This page shows the date it was last revised at the top.