Sub-processors
Last updated: 12 October 2026 (draft v1.3)
These are the third parties that process personal data on a school's behalf when Benchmark.Pulse runs its surveys and reports. Benchmark.Pulse's own suppliers for its sales and support work, where it acts as controller, are described in the website privacy notice. We publish this list, rather than provide it on request, so a school's DPO can check it before signing up. We will give schools at least [30] days' notice of any change (see the data processing agreement, clause 7).
Status means: confirmed where the fact comes from our own configuration or code; to confirm where we still need the supplier's contract, settings or written confirmation. Nothing marked "to confirm" should be relied on yet.
| Sub-processor | Purpose | Personal data it receives | Location of processing | Transfer mechanism | Status |
|---|---|---|---|---|---|
| Supabase (Supabase Inc.) | Database, authentication, file storage, server functions; hosts all survey data | Everything held by the service: school user accounts (email), invitation emails and token hashes, survey responses, reports, audit log | United Kingdom (AWS London region, eu-west-2) [check: production project] | None needed for data at rest in the UK. Supabase Inc. is US-based, so any support or operations access from outside the UK is a restricted transfer: [UK-US data bridge certification / IDTA / Addendum: to confirm] | Region: to confirm. Transfer mechanism: to confirm |
| Anthropic (Anthropic PBC) | AI summarising of free text and writing the report commentary, using Claude through the Anthropic API. Separately, as our own processing rather than on a school's behalf, it drafts replies to emails sent to us (support) | For reports: redacted free-text answers, question wording, computed statistics (percentages and counts), school phase and the title of the survey type. No names of respondents, emails, tokens or IP addresses are sent. Nothing from a survey is sent unless AI commentary is switched on for that survey (it is off by default for pupil surveys) and a full report has been unlocked. Comments flagged for safeguarding are never sent. Redaction is automatic and can miss details, so the text is treated as personal data. For support: the sender's email address, the message, and the school's account and billing details. Never survey answers, comments or safeguarding alerts | [to confirm]. Anthropic API processing is in the US by default [check]; UK or EU processing to be confirmed before launch | [UK-US data bridge / IDTA / Addendum: to confirm] | No training on API data: to confirm against current commercial terms. Zero data retention: to confirm (needs an agreement with Anthropic). Region: to confirm |
| Resend (Resend Inc.) | Sending personal survey links and reminders, safeguarding alerts to the school's safeguarding leads and owners, and sign-in codes to school users. Resend also carries our own billing and support email and receives email sent to our addresses (see the website privacy notice) | Recipient email address and the email body. Survey emails contain the school name, survey title, closing date and the personal link. Safeguarding alerts contain the school name, survey title and a link to the app, never the comment. Resend keeps copies of sent emails, including working personal links, for [check: Resend's retention of sent message content] | EU region (per our plan) [check: sending region configured] | [to confirm] | To confirm |
| Stripe (Stripe Payments Europe Ltd or Stripe Payments UK Ltd [check]) | Card payments and card refunds for reports and the Annual plan. Invoices and credit notes are issued and held by Benchmark.Pulse, not Stripe | Purchaser's email address, the product name, the survey title (for a report), the amount, and internal purchase, survey and school IDs. Card details go directly to Stripe and never reach Benchmark.Pulse. No survey responses or invitation data | [to confirm]; Stripe processes data in the US as well as the UK and EU [check] | [to confirm] | To confirm. Stripe may act as an independent controller for some payment processing (fraud and regulatory checks) [check] |
| Netlify (Netlify Inc.) | Hosting the static web app, including the pages respondents use | No survey data is stored. Netlify necessarily processes visitors' IP addresses and request paths in its logs. The personal link token is not among them: it sits after "#" in the link (/s#token), and browsers do not send that part to the web host |
Global content delivery network; US-based company [check] | [to confirm] | To confirm |
Not sub-processors
- Government open data (DfE Get Information About Schools, and published national survey results used for comparison lines) is downloaded into our database. No personal data is sent to these sources.
- The school's own channels. Personal links are only ever emailed by Benchmark.Pulse through Resend, and are never given to the school. Open links and QR codes, used for pupils and often for parents, are shared by the school through its own channels and carry no personal data.
Planned, not yet in use
| Sub-processor | Purpose | When |
|---|---|---|
| An SMS provider [to choose] | Sending survey links to parents by text | Phase 2 (parent surveys) |
| Wonde | Importing staff and parent contact lists from the school's MIS | Phase 3 |
These will be added to this list, with notice to schools, before any data is sent to them.