Subprocessors & service providers
The categories of providers Icademee may use to operate, secure, and support the platform.
Icademee uses third-party infrastructure and service providers only where they are needed to operate the service, provide requested functionality, maintain security, or meet operational requirements. A provider may process personal data only to the extent necessary for its documented service and under applicable contractual and security controls.
| Provider/category | Purpose | Data involved | International transfer |
|---|---|---|---|
| Supabase | Database, authentication and storage infrastructure | Account and school data as configured | Depends on project region/configuration |
| Vercel | Application hosting and delivery | Request/technical data and application data as required | Depends on deployment configuration |
| Anthropic | Optional mark-sheet OCR/AI processing when explicitly enabled | Uploaded mark-sheet images and extracted academic information | May involve processing outside Nigeria; contractual transfer safeguards required |
OCR is different
External AI processing of identifiable student records is an optional, higher-risk processing activity. Icademee keeps external OCR processing disabled unless the required customer authorisation, privacy review, contractual protections, transfer assessment, and deployment controls have been completed. The OCR data flow is documented separately in our internal DPIA.
Changes
This register is an operational transparency record, not a contractual promise that no other provider will ever be used. New providers that process personal data should go through security, privacy, contractual and transfer review before production use. The customer processing agreement should contain the governing subprocessor-notification and objection mechanism.
Last reviewed: September 2026. Final provider names, regions, retention terms and contractual status must be verified against the live production configuration before launch.