CommonGage Subprocessor List
Last updated: 2026-06-29
CommonGage uses the following third-party subprocessors to deliver its service. All subprocessors are bound by data processing agreements consistent with CommonGage's obligations to districts.
Infrastructure
| Subprocessor | Role | Data Processed | Location |
|---|
| Cloudflare, Inc. | API hosting (Workers), static asset delivery (Pages), DDoS protection, rate limiting | Request/response traffic; Worker secrets at rest | Global edge (data processed in transit; no persistent storage in Workers) |
| Neon, Inc. | Managed PostgreSQL database | All application data (staff accounts, events, deliverables, school/zone structure) | AWS us-east-1 (United States) |
Authentication
| Subprocessor | Role | Data Processed | Location |
|---|
| ClassLink, Inc. | Single sign-on (SSO) for district staff | Staff name, email, ClassLink UserId, district TenantId at login time | United States |
AI / Machine Learning
| Subprocessor | Role | Data Processed | Location |
|---|
| Anthropic, PBC | Event engagement-type classification | Event title, description, and datetime fields only. No staff PII, no student data. | United States |
Development & Operations
| Subprocessor | Role | Data Processed | Location |
|---|
| GitHub, Inc. (Microsoft) | Source code hosting | Source code only; no customer data | United States |
Data Not Shared with Subprocessors
- Staff passwords (hashed locally; hash stored in Neon only)
- JWT session tokens (generated and verified within Cloudflare Workers; not logged or forwarded)
- Database credentials (stored as Cloudflare Worker secrets; not accessible to any third party)
Subprocessor Change Notification
CommonGage will notify districts of any material changes to this subprocessor list (additions of new subprocessors who will process district data) with at least 30 days' notice, providing districts with the opportunity to object. Removal of a subprocessor or changes that reduce data sharing do not require advance notice but will be reflected in an updated version of this document.
Applicable Agreements
| Subprocessor | Relevant Agreement |
|---|
| Cloudflare | Cloudflare Data Processing Addendum |
| Neon | Neon Data Processing Agreement |
| Anthropic | Anthropic API Data Processing Agreement |
| ClassLink | ClassLink Privacy Policy / Data Sharing Agreement |