Skip to main content
Log once. Use everywhere.
For districtsCompliance centerHelp
Evident
Legal & Compliance

Data Processing Agreement

For schools and districts requiring a formal contract regarding data privacy, Evident provides DPA/NDPA documentation for review. The agreement path can support school privacy review, and district-specific terms can be discussed when a standard agreement does not meet local requirements.

Last updated September 2026 ~3 min read Request DPA documentation

Standard Student Data Privacy Agreement

DPA documentation • PDF format. For schools and districts that require a signed agreement, Evident can provide DPA/NDPA documentation for privacy review and execution.

Download DPA documentation

Download the Evident DPA information sheet for school privacy review. This public PDF is not an executed or signed SDPC agreement by itself; email our privacy team if your school or district needs a signed DPA, NDPA, or district-specific terms.

Download Evident DPA PDF • Request a signed agreement

Sub-processors

To provide our service, we engage the following third-party entities to assist with data processing:

  • Supabase: Database & Auth (USA)
  • Vercel: Hosting & Compute (USA)
  • Stripe: Payment Processing (USA)
  • OpenAI: AI-assisted translation, optional AI note polish, and the public-site help assistant, where explicitly invoked (US deployment; redacted before send) (USA)
  • Mistral AI: AI-assisted translation where explicitly invoked, and chart-theme generation from a teacher-typed keyword (EU deployment; student names redacted before sending, no student data in theme requests) (France)
  • Anthropic: AI progress-narrative drafting for IEP progress reports, where explicitly invoked, and chart-theme generation from a teacher-typed keyword (US deployment; student names replaced with placeholders before sending, no student data in theme requests) (USA)
  • Resend: Email Delivery (USA)
  • Sentry: Error Monitoring (USA)
  • Upstash: Rate Limiting (Redis) (USA)
  • PostHog: First-party product analytics & session replay (masked) (USA)

Schools and districts operating under an executed DPA receive at least 30 days' written notice before we add or replace a sub-processor that touches their personal data, with an opportunity to object on reasonable data-protection grounds.

EU deployment cell (data residency)

Schools onboarded to our EU deployment cell (eu.evidentk12.com) have student records stored and processed in the European Union: the database and authentication run in Frankfurt, Germany, and application compute is pinned to the Frankfurt region. The EU cell is a separate deployment with its own database; student records are not replicated to, or accessible from, the US deployment. For EU-cell schools, the sub-processors above operate in the following locations:

  • Supabase: Germany (AWS eu-central-1, Frankfurt)
  • Vercel: Application compute pinned to Frankfurt (fra1)
  • Stripe: USA (school billing contacts only, never student records)
  • OpenAI: Not used (EU translation is provided by Mistral AI; AI note drafting is disabled)
  • Mistral AI: France (Mistral La Plateforme, EU processing)
  • Anthropic: Not used (AI progress-narrative drafting is disabled in the EU cell)
  • Resend: Ireland (AWS eu-west-1 sending region)
  • Sentry: USA (technical error diagnostics; no student records)
  • Upstash: USA (transient rate-limit counters; no student records)
  • PostHog: Germany (PostHog EU Cloud, Frankfurt)

Where a sub-processor is a US company or a service remains US-hosted, transfers are limited to the categories noted above and are covered by our data processing terms, including Standard Contractual Clauses where applicable.

Contact

For DPA requests, subprocessor questions, or district privacy review, contact our privacy team. You can also view our procurement packet for school purchasing.

Evident Privacy Team
privacy@evidentk12.com
DATA PROCESSING AGREEMENTPrivacyComplianceSecurity