Veyay security and subprocessors sheet
Version: 2026-10-14.3 Status: Candidate sheet for adult accounts, adult-run classes, parent-managed learners and personal-study uploads. Publication does not authorize institutional reliance or open any lane.
Controls
- Supabase Auth supplies account authentication; server-side authorization rechecks current relationships and grants.
- The shared Supabase spine separates identity, behavior, and inference domains and uses row-level and service-bound access controls.
- Secrets resolve from 1Password locally and separately provisioned host secrets in production; plaintext production secrets are not committed.
- Individual under-13 coaching binds one reviewed eligible OpenAI-hosted route and one Microsoft Azure OpenAI-hosted route, strictly cheaper first with only the other family as fallback. Under-13 speech, OCR, other auxiliaries and shared book-room coaching remain separately Azure-only. Other coach populations keep their reviewed routes.
- Veyay learner seats are sold today through Stripe-hosted web checkout. Any other purchase channel, such as Apple's App Store, is added to this page before Veyay sells through it. For a parent, the paid seat verifies the parent and is recorded with the parent's separate consent; a seat alone never opens a child's learning without that consent.
- Personal-study material is stored as extracted text only, in tables readable only by the service. No staff screen reads it; complaint handling records only a fingerprint and length of the text.
- Audit/access records support review of privileged and educational access. Support intake carries diagnostic identifiers, not transcript text by default.
- No claim of penetration-test completion, certification, continuous human monitoring, or provider zero retention is made here.
Current subprocessors / service providers
| Provider | Purpose | Typical bounded data | Current posture |
|---|---|---|---|
| Supabase | Authentication, PostgreSQL database, storage | For the adult release: account, acceptance, saved-reading, export/deletion, and audit records; later lanes may add the separately disclosed educational objects | Connected Cour project is in AWS us-west-2 under Cabildo's Pro organization; daily database backup exposes a rolling 7-day history; Storage objects are excluded from database backups; exact institutional contract schedule still required |
| OpenAI | Direct member of the individual under-13 coach family pair; supporting steps (such as safety and context checks) for learners 13 and older and adults | Authorized source, instructions, learner turn and bounded context; no behavioral profile | Exact reviewed eligible route; no API foundation-model training by default; standard abuse-monitoring retention, no Cabildo ZDR claim |
| Microsoft Azure OpenAI | Azure member of the individual under-13 coach pair; the coach for learners 13 to 17 and adults (United States); supporting steps, including a European Union deployment and an Azure-hosted DeepSeek model in Sweden Central, for learners 13 and older and adults; reading study-shelf pages for every learner under 18 | Authorized source, instructions, learner turn and bounded context; for a study-shelf page, the page image or text | Microsoft-operated reviewed deployment; no OpenAI receipt of Azure-hop content; applicable abuse monitoring; no fallback for a learner's study-shelf page |
| Microsoft Azure Speech | Under-13 speech; speech fallback for learners 13 and older and adults, only when Mistral AI's speech service is unavailable | Authorized audio/text needed for the request | Reviewed Azure speech path; under-13 speech has no non-Azure fallback |
| Mistral AI | Speech (primary route) for learners 13 and older and adults, and supporting steps; reading an adult's own study-shelf pages and an adult's class material (for example, a teacher's) | Bounded authorized input; for document reading, the page an adult adds; no under-13 request, and no page a learner under 18 adds (a learner under 18 cannot add material; a parent adds it, read by Azure) | Standard no-training API posture; ZDR not enabled; never an under-13 route |
| Reducto | Document reading an adult may select instead of Mistral (for example, for class material) | Authorized document pages an adult adds | Governed route and age/custody gate; never reads a page for a learner under 18 |
| Railway | Backend application hosting | Requests and operational metadata reaching the API | Production host; logging must exclude raw transcript/lead-form PII by default |
| Vercel | Web application/static delivery | Web requests and ordinary delivery metadata | Public web/app delivery |
| Stripe | Veyay learner seat checkout, renewal, cancellation through its billing page, refunds and disputes | Hosted payment details, payer/household and bounded purchase evidence | Card entry on Stripe's hosted page; Veyay never receives the full card number |
| Proton Mail and any configured transactional-email provider | Published contact routing and account/service email | Recipient, message, and delivery metadata/content | cabildocompanies.com resolves to Proton Mail and the recipient MX accepts the exact published address. This proves recipient acceptance, not staffing or message readback. Account activation requires a separate end-to-end receipt/readback and executed support schedule. |
Change procedure
A material new processor, new data purpose, new jurisdiction, or new model route requires custody review, updated sheet/version/hash, applicable advance notice, and an objection/exit path in the executed institutional agreement. Emergency security substitutions are recorded and disclosed under the agreed timeline. A model change inside an existing provider is not assumed equivalent when its route, retention, training, jurisdiction, or human-review posture differs.