Lectora is operated by Fjordbyte AS (org. no. 933 773 477), Solheimsgaten 7 C, 5058 Bergen, Norway.
This page lists the subprocessors we use to deliver Lectora, what each one does, and where it processes data. We keep it aligned with Annex B of our Data Processing Agreement. Institutional customers receive the full annex, including per-vendor assessments and transfer bases.
Infrastructure
| Subprocessor | Legal entity | Purpose | Processing location |
|---|---|---|---|
| Vercel | Vercel, Inc. (USA) | Application hosting, serverless runtime, edge/proxy layer, builds and operational logs, WAF | EU — Frankfurt (fra1). Access from the USA for operations and support, under Vercel's DPA incl. EU SCCs; Vercel is certified under the EU–US DPF |
| Supabase | Supabase Pte. Ltd. / Supabase, Inc. | Managed PostgreSQL database and object storage (course files, knowledge-base material, uploads, legal documents), user accounts and sessions, application logs | EU — Frankfurt (AWS eu-central-1). Support and administration access from the USA and Singapore, under Supabase's DPA incl. EU SCCs |
AI processing
| Subprocessor | Legal entity | Purpose | Processing location |
|---|---|---|---|
| OpenAI | OpenAI Ireland Limited (EEA contracting party) | AI assistant, AI-assisted grading of submissions, question and quiz generation, learning-outcome extraction, file categorisation and summarisation. Files uploaded for grading and question extraction are transient and deleted after processing; knowledge-base search runs on Fjordbyte's own vector index in Supabase (EU) | EU (region Europe) as the primary endpoint. The global endpoint may be used for development, testing and features not yet available in the EU setup, on the basis of EU SCCs in OpenAI's DPA. No model training on customer data |
| Google Cloud EMEA Limited (EMEA contracting party) | Gemini models used through Vercel AI Gateway — content-editor AI commands | EU/EEA via Google's European infrastructure, under Google Cloud's DPA incl. EU SCCs. No model training on customer data | |
| Anthropic | Anthropic Ireland, Limited (EEA contracting party) | Claude models for grading support and content generation. Approved and planned; not enabled in production as of 24.08.2026 | EU/EEA contracting party. Transfers to the USA on the basis of EU SCCs in Anthropic's DPA. No model training on customer data; API inputs and outputs deleted within 30 days |
| Mistral AI | Mistral AI SAS (France) | OCR and image understanding for documents uploaded to a course knowledge base — extraction of text, structure and figure descriptions from PDF, Word, PowerPoint and image files. Called statelessly; no file objects are created at the vendor | EU (France). No third-country transfer. Zero Data Retention enabled on the production account |
| Vercel AI Gateway | Vercel, Inc. (USA) | Routing layer for part of the AI functionality — forwards prompt, context and model response to the selected model provider, and processes usage metadata (model, token count, timestamp) | EU/USA under Vercel's DPA incl. EU SCCs. Onward processing takes place at the model provider's location listed above |
Available models are restricted in code to a fixed list. Adding a model provider that is not listed here is treated as a change of subprocessor and follows the change procedure in Annex B of the DPA.
Operations
| Subprocessor | Legal entity | Purpose | Processing location |
|---|---|---|---|
| Inngest | Inngest, Inc. (USA) | Workflow orchestration (durable execution) for background jobs. Receives internal identifiers and job metadata only — never student names, submissions, attachments or grading material | USA (AWS). No EU region. See transfer note below |
| Resend | Plus Five Five, Inc. (USA) | Transactional email — verification, invitations, notifications and links | USA. Transfers under EU SCCs in Resend's DPA; Resend states EU–US DPF certification |
| Sentry | Functional Software, Inc. (USA); EU representative Sentry Software Netherlands B.V. | Error monitoring and performance tracing. Region locked in code | EU — Frankfurt, Germany (Sentry EU region) |
| PostHog | PostHog, Inc. / PostHog GmbH | Product analytics, feature flags, experimentation, session replay and error tracking. Region locked in code | EU — Germany (PostHog Cloud EU on AWS) |
Billing
| Subprocessor | Legal entity | Purpose | Processing location |
|---|---|---|---|
| Stripe | Stripe Payments Europe, Limited (EEA contracting party) / Stripe, Inc. | Billing, checkout and webhooks. Card data is processed and stored only by Stripe (PCI DSS Level 1) | EEA (Ireland) as contracting party; global under Stripe's DPA and Stripe's own subprocessor list |
Not subprocessors
Canvas is your institution's own system. The Canvas integration (LTI 1.3 and the Canvas API) runs in Fjordbyte's own environment, and Canvas is not a subprocessor under our DPA.
Authentication is handled by Better Auth, a self-hosted library storing users and sessions in our own database. No external authentication provider is used.
Self-hosted object storage (Garage) is operated by Fjordbyte itself for installations that require local storage, and involves no additional subprocessor.
International transfers
Customer content — submissions, grades, feedback, chat and knowledge-base material — is processed within the EU/EEA.
Some operational services are located outside the EEA. For each of them we state the transfer basis in the tables above. Where a service is US-based and processes personal data, we rely on EU Standard Contractual Clauses in the vendor's data processing agreement (and, where the vendor is certified, the EU–US Data Privacy Framework), supported by encryption in transit (TLS 1.2+) and at rest (AES-256), and by data minimisation.
Transfer note — Inngest. Inngest orchestrates background jobs but does not process customer content: event payloads are limited to internal identifiers and job metadata — never student names, submissions or grading material — and are additionally protected by end-to-end encryption, so Inngest cannot read payload contents. Inngest's data processing terms apply; a data processing agreement incorporating the EU Standard Contractual Clauses is being concluded, and we are additionally consolidating background execution onto EU-resident infrastructure.
Changes to this list
We maintain an up-to-date list of all subprocessors on this page. Institutional customers are notified of like-for-like replacements within five working days of the change, and of material changes at least one month before they take effect, with a right to object on reasonable grounds. The procedure is set out in Annex B of our Data Processing Agreement.
Questions? Contact us at lectora@fjordbyte.no.