This register covers every third party that processes, stores or transmits data on behalf of Reason Education (ABN 17 374 306 140) in delivering the staff portal and the student app.
It sits alongside the Hosting and Data Residency statement, which describes where each component runs, and the Privacy Policy and Collection Notice, which describe what is collected and why. Where those documents say “a third party”, this is the document that names it.
What this list is, and what makes it complete
1.1This is the whole list. Four entries, and there is no fifth hidden behind a generic “our service providers may include” sentence, because that sentence is what a register exists to replace.
1.2Two things are worth stating up front, because they are the usual sources of a missing row. The first is what is absent from the applications entirely; the second is the third-party code that ships with them and is not a sub-processor.
1.3There are no analytics, trackers, advertising networks, remote CDNs or remote webfonts in either application. Not on staff pages, and certainly not on any page a child sees. This was verified by scanning the tree, not assumed.
Specifically, none of the following is present anywhere in the product:
- Analytics or product-telemetry services
- Advertising networks, tag managers or marketing pixels
- Remote content delivery networks
- Remotely hosted webfonts
1.4Two third-party JavaScript libraries ship vendored and are served from our own origin — qrcode.js and jsqr.js. They are the entire dependency inventory; there is no package manager in this project. They send nothing anywhere and are therefore not sub-processors, but they are named here so that the answer to “what third-party code runs?” is on the record.
The register
2.1One row per sub-processor. Each row names the organisation and how to reach it, exactly what it receives, what it is for, the lawful basis on which it is disclosed, and the country the processing happens in. The register table is the document; everything else on this page explains it.
| Sub-processor and contact | What it receives | Purpose | Lawful basis | Country of processing |
|---|---|---|---|---|
|
Anthropic PBC AI model provider — Claude API and Admin API anthropic.com · privacy@anthropic.com · support.anthropic.com |
Inference: the image of a child’s handwritten working out, the question text, the answer given, our own correct or incorrect mark, and a year-level band. No name, no student number, no database id, no pseudonymous token. Admin API: our own organisation’s workspace names and API usage counts. No school or student data. |
To produce a description of the method the child used, which a teacher reads and decides on. | Processing on the documented instruction of the school under the school agreement, for the primary purpose the information was collected (APP 6.1(a)). Overseas disclosure under APP 8.1, with the contractual safeguards at section 3. | United States |
|
Microsoft Corporation Microsoft Azure — App Service, Azure Database for MySQL Flexible Server, and Blob Storage once the image migration is done azure.microsoft.com · azure.microsoft.com/support · privacy.microsoft.com |
Everything the service holds: student names, year levels, our student numbers, emoji, assessment answers, working-out images, curriculum judgements, growth history; staff names, emails, password hashes, TOTP secrets; audit and mail logs. Working-out images sit inside the database today, and move to Azure Blob Storage once migrated. |
Hosting, database and storage. Microsoft processes as infrastructure and does not access the content. | Processing on the documented instruction of the school under the school agreement, for the primary purpose (APP 6.1(a)). No overseas disclosure — the data stays in Australia. | Australia — Azure Australia Southeast (Melbourne) |
|
Namecheap, Inc. Namecheap Private Email — account and service email. In service since 8 September 2026; see section 4. namecheap.com · namecheap.com/support · namecheap.com/legal/general/privacy-policy |
Staff name and school email address; the content, subject and delivery outcome of account and service email — invitations, password resets, security notices, policy updates — including the single-use account-recovery token URL carried in a reset message. No student data of any kind, ever. | Delivering account and service email to staff addresses, and recording whether it arrived. | Necessary to deliver the service to the school and to operate staff accounts securely (APP 6.1(a)). APP 8.1 is engaged: this is a disclosure to an overseas recipient, and it is named here for that reason. | United States |
|
Amazon Web Services, Inc. Amazon Simple Email Service (SES) — intended transactional email provider. Decided, not engaged, sending nothing; see section 4. aws.amazon.com · aws.amazon.com/contact-us · aws.amazon.com/privacy |
Nothing today. On the same data as the row above, once engaged. | Intended to replace the row above, on residency grounds. | Listed before it processes anything, rather than added quietly afterwards. | Australia — ap-southeast-2 (Sydney), when engaged |
|
Have I Been Pwned Pwned Passwords range API, operated by Superlative Enterprises Pty Ltd haveibeenpwned.com · haveibeenpwned.com/API/v3 |
The first five hexadecimal characters of a SHA-1 hash, sent when a staff member sets or changes a password. Nothing else. No password, no name, no email, no school, no student data, no account identifier. | To check the password against known breach corpora. The query is k-anonymous — the recipient cannot determine the password or who is setting it. | Necessary for the security of the service and to meet our obligation to protect personal information (APP 11.1). No personal information is disclosed, so APP 6 and APP 8 are not engaged. | Served from Cloudflare’s global edge network, so the request may terminate outside Australia. The operator, Superlative Enterprises Pty Ltd, is an Australian company. The request carries no personal information wherever it lands. |
Where working-out images actually sit
An earlier draft of this register stated as fact that working-out images are held in Azure Blob Storage. They are not, today. There is no blob-storage client in the product and the images are held inside the database, which is why the Azure row reads “once migrated” — the same qualification the Personal Information Holdings Register carries. Same provider and the same Melbourne region either way, so nothing about the country, the disclosure or the lawful basis changes.
Terms we require of every sub-processor
A register that lists names without terms is a phone book. Each of the five below is a condition of engagement, not a preference.
3.1No training on our data. No school or student data may be used to train, fine-tune, evaluate or otherwise improve any model. With the model provider this is contractual, backed by the API’s own no-training setting, and checked as a documented step — all three, or we do not treat it as a control.
3.2Zero retention on the provider’s side for model inference. A provider that will not offer it is disqualified.
3.3Data stays in the stated region for storage. Azure resources are pinned to Australia Southeast. Melbourne specifically, and not Sydney, because Victorian privacy law treats a transfer outside Victoria as a transborder question in its own right.
3.4Written notice of a breach affecting our data, promptly, so we can meet our own obligations to schools under the Notifiable Data Breaches scheme.
3.5No onward sub-processing of school or student data without our written agreement — which would itself become a new row in this register.
The email provider — Namecheap now, Amazon SES intended
Account email is sent through Namecheap Private Email, in the United States. Amazon SES in Sydney is the intended provider and is not engaged; nothing is sent through it. The row for each is in the register above, and a school is told before this changes.
4.1Residency decided it. Three candidates were named in the source — Resend, Postmark and Amazon SES. Two of the three have no Australian region. That is why SES remains the intended provider. It is not the position today: while account email runs through Namecheap Private Email, staff names, school email addresses and the single-use account-recovery token URLs inside reset messages are disclosed to a recipient in the United States.
4.2The reason a transactional provider is needed at all is deliverability, not convenience. Australian schools sit almost entirely behind Microsoft 365 or Google Workspace, and Victorian government schools inside the Department’s tenancy with filtering tuned hard against exactly our message shape: an unfamiliar sender, a personal greeting, and a link asking the reader to set a password.
Such a message is not bounced — it is quarantined silently, and the school reports that its teachers never got their email. SPF, DKIM, DMARC alignment and a reputable sending IP pool are the four things that fix it, and shared hosting’s mail() gives none of them.
4.3Two of the selection criteria were privacy criteria, and they decided it: whether the provider can process and store in Australia, and how long it retains message content and recipient addresses. SES in ap-southeast-2 answers the first, and the second is settled in the processing agreement below.
4.4The three outstanding items, with an owner and a date on each. Nothing is sent through SES while any of them is open.
| Outstanding item | Owner | Due |
|---|---|---|
| Domain verification for reasoneducation.com.au — SPF, DKIM and DMARC records published and verified in SES | Jacob Clemens | 30 September 2026, and blocked on reasoneducation.com.au |
| SES sandbox exit — a new SES account can only send to verified addresses, which is not a working service | Jacob Clemens | Before date golive — to be confirmed |
| Data processing agreement executed with AWS, carrying a breach-notification obligation and a stated message-retention period | Jake Gatto | Before date golive — to be confirmed |
4.5The retention period is recorded here once it exists. The period AWS applies to message content and recipient addresses is written into this register once the agreement is executed, and schools are notified under the change process in section 5.
When this register changes, and the notice you get
30 days, and 90 days for a change of country
We notify every customer school in writing at least 30 days before a new sub-processor begins processing school or student data, or before an existing one is replaced. Where the change is a change of country — the hosting country for the live service or backups, or the country the AI model is hosted or served from — the notice period is 90 days, because that is a decision a school may need to take to its own department before it takes effect. Both periods match clause 5.4 of the school agreement.
| A new sub-processor begins processing school or student data | At least 30 days written notice, before it begins. |
|---|---|
| An existing sub-processor is replaced | At least 30 days written notice, before the replacement begins. |
| A change of country — hosting for the live service or backups, or where the AI model is hosted or served from | At least 90 days written notice. |
| A sub-processor is removed, or what one receives is narrowed | Takes effect immediately, and is notified within 30 days after the fact. |
5.1What the notice says. It names the sub-processor, what it will receive, why, and where it will process.
5.2A school that objects can say so, and can leave. A school that objects within those 30 days can raise it with us, and if we cannot resolve it the school may terminate for that reason without penalty and have its data returned or destroyed.
5.3A reduction in exposure does not wait. Removing a sub-processor, or narrowing what one receives, takes effect immediately and is notified within 30 days after the fact — there is no reason to make a school wait for a reduction in exposure.
5.4A change here is a change to two other documents. Any change is also a change to the Privacy Policy and the Collection Notice, which carry their own 14-day notification and acceptance-on-next-sign-in requirement.
5.5Superseded versions stay available. This register carries a version and a date. Once the page exists, every superseded version will stay available at reasoneducation.com.au/sub-processors/versions; until then superseded versions are held on file and supplied on request.
5.6The commitment needs no code to honour. The 30-day commitment applies from the day this register is issued. The notification is sent by the Privacy Officer.
Change log
- 1.1Namecheap Private Email added as the live account-email provider, in service from this date. Amazon SES kept in the register as the intended provider, decided and not engaged. Clause 4.1 corrected: it said this data now stays in Australia, and while Namecheap carries it that is a disclosure to the United States.
- 1.0First issue. Four sub-processors listed. Transactional email provider decided — Amazon SES,
ap-southeast-2(Sydney) — with domain verification, sandbox exit and the processing agreement outstanding. No processing has begun with any of the four.
One correction carried before issue
Version 1.0 of the source document said that working-out images are held in Azure Blob Storage. That was not true, and this page says instead that they are held inside the database today and move to Blob Storage once migrated — matching the wording the Personal Information Holdings Register already carried. The correction was made before issue, so no school was told the earlier version.
Next review: 18 February 2027, or immediately on engaging, replacing or removing any sub-processor.