Subprocessors and data locations
This reference lists third-party services ("subprocessors") that process data on behalf of SpeechGradebook when your institution uses the hosted product. It applies to IT security, privacy, and procurement reviewers.
ValidBound LLC operates SpeechGradebook. Institution-specific data processing terms may add or restrict subprocessors — contact ValidBound for a current list or DPA.
Data flow (hosted product)
flowchart LR
User[Instructor or student browser]
App[SpeechGradebook app API]
DB[(Supabase PostgreSQL and Storage)]
Model[SpeechGradebook Model service]
User --> App
App --> DB
App --> Model
Model --> App
App --> User
When an instructor runs an evaluation, the app sends the rubric and speech media (or a storage URL) to the configured model service. Results are stored in Supabase when student consent allows cloud storage.
Subprocessor table
| Subprocessor | Role | Data processed | Typical location | Notes |
|---|---|---|---|---|
| Supabase | Authentication, PostgreSQL database, object storage | User accounts, courses, rosters, rubrics, evaluations, consent records, audit logs, speech media (when consent allows) | United States (project region) | Supabase security. Row-level security enforces institution and role boundaries. |
| Render | Hosts the SpeechGradebook web application and API (Docker) | Request metadata, session/API traffic, application logs; evaluation jobs may pass media references through the app tier | United States | Render security. Does not replace Supabase as the system of record. |
| Modal | GPU inference for the SpeechGradebook Text + Video Model (Qwen) | Rubric JSON and speech media (or fetch URL) for the duration of an evaluation job | United States | Modal security. Production uses a dedicated model endpoint, not consumer third-party LLM APIs. |
| GitHub | Builds and hosts public documentation (docs.speechgradebook.com) | Documentation content only — no student education records | United States | GitHub Pages serves the docs site. The product app does not store student data on GitHub. |
| Cloudflare | DNS for speechgradebook.com and docs.speechgradebook.com | DNS query metadata only when DNS-only (grey-cloud) records are used | Global DNS network | DNS-only mode does not proxy application traffic. |
What is not a subprocessor for typical hosted use
| Service | Why it is listed here |
|---|---|
| Consumer LLM APIs (OpenAI, Anthropic, Google Gemini, etc.) | Not used in the default hosted SpeechGradebook Model path. Legacy or self-hosted configurations may differ — confirm with your admin. |
ValidBound marketing site (validbound.com) | Company information only; product sign-in and data processing occur on speechgradebook.com. |
Data categories by subprocessor
| Category | Supabase | Render | Modal |
|---|---|---|---|
| User account and profile | Yes | Transient (requests) | No |
| Course and roster data | Yes | Transient | No |
| Rubrics and evaluation results | Yes | Transient | Rubric + media for job duration |
| Speech audio/video | Yes (with consent) | Transient / URL pass-through | Job duration |
| Audit and compliance logs | Yes | Application logs | No |
Evaluations for students without consent may remain in browser local storage only and are not persisted to Supabase until consent is recorded. See Consent and data storage.
Documentation and marketing surfaces
| Surface | URL | Student data |
|---|---|---|
| Product app | www.speechgradebook.com | Yes (when using cloud features) |
| Documentation | docs.speechgradebook.com | No |
| Company site | www.validbound.com | No |
Security controls (summary)
See Security overview for authentication, encryption, RLS, and audit logging detail.
- Encryption in transit: HTTPS for browser and API traffic; TLS for service-to-service calls.
- Encryption at rest: Supabase and cloud storage providers encrypt data at rest per their platform defaults.
- Access control: Role-based UI plus Supabase row-level security (RLS). See Role permissions.
- Audit logging: Access to evaluation data is logged. See FERPA and student records.
Institution requests
ValidBound can provide:
- An updated subprocessor list for your contract year
- Answers to security questionnaires
- Discussion of institution-specific retention, deletion, and data use terms
Contact ValidBound support.