| Provider | Purpose | Region | Agreement | Attestations |
|---|---|---|---|---|
| Neon (Databricks) | PostgreSQL database — all application data | aws-us-west-2 (fixed at project creation) | incorporated · terms | SOC 2 Type II, SOC 3, ISO 27001, ISO 27701, HIPAA (Scale plan; BAA via self-serve) |
| Railway | Application hosting (Next.js server, logs) | us-west2 California (per service) | NOT EXECUTED — must submit DocuSign · terms | SOC 2 Type II, SOC 3, HIPAA BAA add-on above a spend threshold |
| AWS S3 | Document storage: BIP/FBA PDFs, uploaded student documents, feedback screenshots | us-west-1 (chosen; AWS does not move content) | incorporated · terms | SOC 2 Type II via Artifact, HIPAA-eligible service |
| Anthropic (Claude API) | Drafting session notes, FBA narrative, BIP text from student data | US inference pinning only for Claude 4.6+ models; workspace geo 'us' at creation | incorporated · terms | SOC 2 Type I & II, ISO 27001:2022, ISO/IEC 42001:2023, HIPAA-ready configuration (BAA from the Console) |
| Resend | Transactional email: assessment links to parents, invitations, timesheet PDFs, digests | United States (message content, logs, webhooks) | incorporated · terms | SOC 2 Type II |
| Stripe | Billing (organization contacts only; no student data) | US | incorporated · terms | PCI DSS Level 1 |
| Google Identity (OAuth) | Staff sign-in | n/a | incorporated · terms | — |
| GitHub | Source hosting; one Actions workflow (reap-sessions) calling the production reaper | US | incorporated · terms | SOC 2 |
| OpenStreetMap / OpenTopoMap tile servers; US Census geocoder; OSRM router | Map tiles for school/site maps; staff home-address geocoding; route distance | public internet | none — unauthenticated public services · terms | — |
Retention and AI-training terms for each provider are recorded in our vendor register and reviewed at every compliance audit. Questions: privacy@beehaveur.com.