Who we share with

The list

• Microsoft Azure

  Hosting, database, file storage and system telemetry

  What they receive: All application data, encrypted at rest and in transit. Azure is the infrastructure the product runs on rather than a party we send data to.

  Why they are needed: The application has to run somewhere.

  Can reach student data.

• Microsoft Azure OpenAI Service

  Powers the assistant when a user asks it a question

  What they receive: The text of the question and a scoped summary of the relevant record. Directly identifying details are masked before the request leaves our systems. Requests are not used to train any model.

  Why they are needed: The assistant needs a language model. It runs inside our own Azure tenancy under the same agreement as the rest of our infrastructure rather than on a separate vendor’s consumer terms. We log every request and cap usage per school.

  Can reach student data.

• Resend

  Delivers transactional email — invitations, verification links, password resets

  What they receive: Recipient name and email address, and the contents of that message.

  Why they are needed: Email has to be handed to a mail provider to be delivered.

  Can reach student data.

• Google

  Sign-in, for schools that use Google Workspace

  What they receive: Only what is exchanged during sign-in, and only for users who sign in this way. Google is not sent any record from the product.

  Why they are needed: Single sign-on requires talking to the identity provider.

  Does not receive student records.

• Sentry

  Reports application errors so we can fix them

  What they receive: Technical diagnostics — the error, the code path, the browser. Personally identifying fields are switched off by configuration rather than by policy.

  Why they are needed: Errors that are never reported are never fixed.

  Does not receive student records.

What is deliberately absent

There is no analytics service, no advertising network, no marketing pixel, no session-replay tool and no A/B testing service anywhere in this site. Not switched off — not present. You can confirm it yourself in your browser’s network tab.

Web fonts are served from our own domain rather than fetched from Google, so simply loading a page does not tell anyone else that you visited.

Changes

If we add a company to this list we will update this page when the change ships, and tell schools before it affects student data. If you want to be told about changes here, write to privacy@veristack.dev.