Data Processing Agreement
For schools and districts requiring a formal contract regarding data privacy, Evident provides DPA/NDPA documentation for review. The agreement path can support school privacy review, and district-specific terms can be discussed when a standard agreement does not meet local requirements.
Standard Student Data Privacy Agreement
DPA documentation • PDF format. For schools and districts that require a signed agreement, Evident can provide DPA/NDPA documentation for privacy review and execution.
Download the Evident DPA information sheet for school privacy review. This public PDF is not an executed or signed SDPC agreement by itself; email our privacy team if your school or district needs a signed DPA, NDPA, or district-specific terms.
Sub-processors
To provide our service, we engage the following third-party entities to assist with data processing:
- Supabase: Database & Auth (USA)
- Vercel: Hosting & Compute (USA)
- Stripe: Payment Processing (USA)
- OpenAI: AI-assisted translation where explicitly invoked (US deployment) (USA)
- Mistral AI: AI-assisted translation where explicitly invoked (EU deployment; student names redacted before sending) (France)
- Resend: Email Delivery (USA)
- Sentry: Error Monitoring (USA)
- Upstash: Rate Limiting (Redis) (USA)
- PostHog: First-party product analytics & session replay (masked) (USA)
EU deployment cell (data residency)
Schools onboarded to our EU deployment cell (eu.evidentk12.com) have student records stored and processed in the European Union: the database and authentication run in Frankfurt, Germany, and application compute is pinned to the Frankfurt region. The EU cell is a separate deployment with its own database; student records are not replicated to, or accessible from, the US deployment. For EU-cell schools, the sub-processors above operate in the following locations:
- Supabase: Germany (AWS eu-central-1, Frankfurt)
- Vercel: Application compute pinned to Frankfurt (fra1)
- Stripe: USA (school billing contacts only, never student records)
- OpenAI: Not used (EU translation is provided by Mistral AI; AI note drafting is disabled)
- Mistral AI: France (Mistral La Plateforme, EU processing)
- Resend: Ireland (AWS eu-west-1 sending region)
- Sentry: USA (technical error diagnostics; no student records)
- Upstash: USA (transient rate-limit counters; no student records)
- PostHog: Germany (PostHog EU Cloud, Frankfurt)
Where a sub-processor is a US company or a service remains US-hosted, transfers are limited to the categories noted above and are covered by our data processing terms, including Standard Contractual Clauses where applicable.
Contact
For DPA requests, subprocessor questions, or district privacy review, contact our privacy team. You can also view our procurement packet for school purchasing.