Subprocessors and data locations
This reference lists third-party services ("subprocessors") that process data on behalf of SpeechGradebook when your institution uses the hosted product. It applies to IT security, privacy, and procurement reviewers.
ValidBound LLC operates SpeechGradebook. Institution-specific data processing terms may add or restrict subprocessors — contact ValidBound for a current list or DPA.
Data flow (hosted product)
flowchart LR
User[Instructor or student browser]
App[SpeechGradebook app API]
DB[(Supabase PostgreSQL and Storage)]
Model[SpeechGradebook Model service]
User --> App
App --> DB
App --> Model
Model --> App
App --> User
When an instructor runs an evaluation, the app sends the rubric and speech media (or a storage URL) to the configured model service. Results are stored in Supabase for instructional use. ValidBound LLM / R&D exports require affirmative student consent.
Subprocessor table
| Subprocessor | Role | Data processed | Typical location | Notes |
|---|---|---|---|---|
| Supabase | Authentication, PostgreSQL database, object storage | User accounts, courses, rosters, rubrics, evaluations, consent records, audit logs, speech media | United States (project region) | Supabase security. Row-level security enforces institution and role boundaries. |
| Render | Hosts the SpeechGradebook web application and API (Docker) | Request metadata, session/API traffic, application logs; evaluation jobs may pass media references through the app tier | United States | Render security. Does not replace Supabase as the system of record. |
| Modal | GPU inference for the SpeechGradebook Text + Video Model (Qwen) | Rubric JSON and speech media (or fetch URL) for the duration of an evaluation job | United States | Modal security. Production uses a dedicated model endpoint, not consumer third-party LLM APIs. |
| Stripe | Payments for Practice Plus and ValidBound Coaching | Billing identity, payment method metadata, subscription status (not course gradebook content) | United States (Stripe) | Stripe privacy. Used for paid Practice/coaching offers. |
| SMTP provider (when configured) | Transactional email | Consent or operational email content and recipient addresses | Depends on configured provider | Used when server-side mail is enabled; otherwise instructors may send consent via their own mail client. |
| Sentry (optional) | Error monitoring | Technical error context; may include authenticated user id when configured | United States (typical) | Enabled only when SENTRY_DSN is set. |
| GitHub | Builds and hosts public documentation (docs.speechgradebook.com) | Documentation content only — no student education records | United States | GitHub Pages serves the docs site. The product app does not store student data on GitHub. |
| Cloudflare | DNS for speechgradebook.com and docs.speechgradebook.com | DNS query metadata only when DNS-only (grey-cloud) records are used | Global DNS network | DNS-only today (does not proxy or WAF application traffic). Edge proxy/WAF can be enabled for institutional deployments on request. |
What is not a subprocessor for typical hosted use
| Service | Why it is listed here |
|---|---|
| Consumer LLM APIs (OpenAI, Anthropic, Google Gemini, etc.) | Not used in the default hosted SpeechGradebook Model path. Legacy or self-hosted configurations may differ — confirm with your admin. |
ValidBound marketing site (validbound.com) | Company information only; product sign-in and data processing occur on speechgradebook.com. |
Data categories by subprocessor
| Category | Supabase | Render | Modal |
|---|---|---|---|
| User account and profile | Yes | Transient (requests) | No |
| Course and roster data | Yes | Transient | No |
| Rubrics and evaluation results | Yes | Transient | Rubric + media for job duration |
| Speech audio/video | Yes (instructional hosting) | Transient / URL pass-through | Job duration |
| Audit and compliance logs | Yes | Application logs | No |
Instructional evaluations are stored in Supabase when enrollment can be resolved. Affirmative student consent is required for ValidBound LLM / R&D exports only. See Consent and data storage.
Documentation and marketing surfaces
| Surface | URL | Student data |
|---|---|---|
| Product app | www.speechgradebook.com | Yes (when using cloud features) |
| Documentation | docs.speechgradebook.com | No |
| Company site | www.validbound.com | No |
Security controls (summary)
See Security overview for authentication, encryption, RLS, and audit logging detail.
- Encryption in transit: HTTPS for browser and API traffic; TLS for service-to-service calls.
- Encryption at rest: Supabase and cloud storage providers encrypt data at rest per their platform defaults.
- Access control: Role-based UI plus Supabase row-level security (RLS). See Role permissions.
- Audit logging: Access to evaluation data is logged. See FERPA and student records.
Institution requests
ValidBound can provide:
- An updated subprocessor list for your contract year
- Answers to security questionnaires
- Discussion of institution-specific retention, deletion, and data use terms
Contact ValidBound support.