Legal & Policies
Sub-Processors
The third parties we engage to help deliver ProvisionIQ, what each one does, what data they may see, and where they are located.
Last updated: September 2026
As referenced in our Data Processing Agreement and GDPR Statement, this page lists the current sub-processors ProvisionIQ engages to help deliver the platform on behalf of schools, trusts, and local authorities. We update this page within 14 days of any change, and notify Data Controllers of any new sub-processor with the same notice period, in line with our Data Processing Agreement.
Current sub-processors
Amazon Web Services EMEA SARL (AWS)
- What they do for us
- Cloud hosting for the platform database, file storage, application servers, and content delivery (Amazon RDS, Amazon S3, Amazon EC2, Amazon CloudFront); outbound platform email (Amazon SES).
- Data they may process
- All personal data stored on the ProvisionIQ platform, including pupil SEND data, evidence uploads, and staff/parent account data.
- Location
- United Kingdom (eu-west-2, London)
- International transfer
- None — data stays in the UK.
Anthropic, PBC
- What they do for us
- Processes text for ProvisionIQ's opt-in AI-assisted features: suggested outcomes, provisions, and one-page-profile entries; document-import suggestions; and aggregated, org-level Ofsted-readiness analysis.
- Data they may process
- Only for organisations that have switched on the relevant AI feature. Text is stripped of direct identifiers (pupil name, date of birth, NHS number, email, phone) by our platform before it is sent. The org-level Ofsted analysis sends no pupil data at all.
- Location
- United States
- International transfer
- Covered by Anthropic's Data Processing Addendum, which incorporates the UK Information Commissioner's International Data Transfer Addendum (template v B.1.0) for any data subject to UK GDPR.
Systems we connect to that are not sub-processors
If your school has already connected its own Management Information System (MIS), we read pupil roster data from it at your instruction, using your own connection details. We don't send these systems any personal data, and they already hold this data independently as your school's own MIS provider. For that reason, we don't treat them as ProvisionIQ sub-processors.
Arbor Education Partners Ltd (Arbor MIS)
Where a school connects its own Arbor MIS account, ProvisionIQ reads pupil roster data from Arbor at the school's instruction and using the school's own connection. We do not send Arbor any personal data, and Arbor already holds this data as the school's separate MIS provider under the school's own arrangement with Arbor — so Arbor is not a ProvisionIQ sub-processor.
WCBS Ltd (HubMIS)
Same relationship as Arbor above: a read-only, on-demand import of roster data from the school's own HubMIS account, at the school's instruction. WCBS is not a ProvisionIQ sub-processor.
Our standard sub-processor terms
- •We only engage sub-processors who provide contractual guarantees equivalent to UK GDPR Article 28(4).
- •Where a sub-processor is located outside the UK, we put in place an appropriate transfer safeguard (such as a UK International Data Transfer Addendum) before any personal data is sent to them.
- •We give Data Controllers at least 14 days' written notice before engaging a new sub-processor or replacing an existing one, and Controllers may object within that window under our Data Processing Agreement.
- •ProvisionIQ remains fully liable to Data Controllers for the performance of every sub-processor we engage.
Questions?
If you have a question about any sub-processor listed here, or want to object to a new one under your Data Processing Agreement, contact us at dpo@provisioniq.org.