Subprocessors
version 2026-06-24 · effective 2026-06-24
This page is maintained by Acorn & Orbit (a product of ECHO Technologies). It is written to be accurate and conservative but is not legal advice. For your specific situation please consult a qualified attorney.
Current subprocessors
A&O uses the third parties below to provide the platform. Each is contractually bound to security and confidentiality obligations no less protective than this Operator Agreement.
| Subprocessor | Purpose | Region | Safeguards |
|---|---|---|---|
| Supabase (managed Postgres + Auth + Storage) | Core application database, authentication, file storage. | EU / USA | DPA, SCCs where applicable. |
| Cloudflare Workers | Edge runtime, CDN, DDoS protection. | Global edge, primary region SA. | DPA, SCCs. |
| Paystack | Payment processing for school fees. | South Africa / Nigeria | PCI-DSS, contract terms. |
| Email service provider (transactional) | Sending account & school-communication emails. | EU / USA | DPA, SCCs. |
| Sentry / error reporting | Runtime error capture for reliability. | EU | DPA, IP-scrubbing enabled. |
| Lovable AI Gateway | Optional AI features (when explicitly enabled). | EU / USA | DPA. |
Updates
Schools subscribed to A&O will receive at least 30 days' notice before a new or replaced subprocessor takes effect.
Questions? Email legal@investechotech.com.