1. Overview of Subprocessors
A subprocessor is a third-party vendor engaged by MyEduOS to assist in delivering aspects of our cloud platform (such as hosting infrastructure, transactional messaging, or automated fee payments).
We select partners that demonstrate world-class reliability, enterprise compliance certifications, and strict adherence to data security standards.
2. Active Subprocessor Registry
The following third-party service providers are currently authorized to process data on behalf of MyEduOS:
| Subprocessor Name | Category & Function | Data Processed | Hosting Jurisdiction | Certifications |
|---|---|---|---|---|
| Amazon Web Services (AWS) / Cloud Hosting | Virtual compute instances, managed PostgreSQL database clusters, and system backups. | Encrypted tenant database records, audit logs, and system metrics. | Mumbai / Hyderabad, India | ISO 27001, SOC 1/2/3, PCI-DSS |
| Razorpay Software Pvt. Ltd. | Processing online school fee transactions via UPI Intent, Net Banking, and Debit/Credit cards. | Transaction amount, invoice number, student admission ID, guardian contact info. | Bangalore, India | PCI-DSS Level 1, ISO 27001 |
| Amazon Simple Email Service (SES) | Dispatching system emails including password resets, account invitations, and fee receipt PDFs. | Recipient name, email address, message metadata. | Mumbai, India | ISO 27001, SOC 2, HIPAA Eligible |
| Exotel / Meta WhatsApp Business Cloud API | Delivering time-critical SMS alerts, 2FA login OTPs, daily attendance notices, and transport updates. | Guardian mobile phone number, alert text payload, timestamp. | India | TRAI DLT Compliant, ISO 27001 |
| Mapbox & OpenStreetMap | Rendering live interactive maps and bus route coordinates for school fleet GPS tracking. | Vehicle GPS coordinates, stop geocodes (No personal student records transferred). | Global / APAC Edge | SOC 2, ISO 27001 |
| Google LLC (Google Tag Manager & Google Analytics) | Measuring visits and contact/demo form submissions on the public myeduos.com marketing website. Never loaded inside the signed-in platform or on an institution’s own address. | Pages visited, referring site, device and browser type, approximate location, analytics cookie identifiers. No student, parent, staff or institution records. | Global (Google data centres) | See Google’s privacy and security documentation |
| Cloudflare R2 / AWS S3 | Storing encrypted student ID photos, generated ID card PDFs, and Transfer Certificate scans. | Uploaded documents, profile pictures, generated PDF files (encrypted at rest). | India / Regional Edge | SOC 2 Type II, ISO 27001 |
3. Security & Contractual Commitments
Prior to onboarding any subprocessor, MyEduOS mandates:
- Data Protection Agreements (DPAs): Legally binding agreements enforcing GDPR, DPDP Act 2023, and FERPA standards.
- Encryption in Transit: Mandatory TLS 1.3 encryption across all API integrations and inter-service communications.
- Data Minimization: Vendors only receive the exact fields necessary to perform their specific function (e.g., map services receive vehicle coordinates only, never student names).
4. Advance Change Notification Guarantee
MyEduOS commits to maintaining transparency with institution administrators:
- We provide at least 30 calendar days advance notice to designated institution Super Admins before engaging any new critical subprocessor that processes personal student or staff data.
- Institutions have the right to review the security posture of proposed subprocessors and raise reasonable objections based on compliance requirements.
5. Questions or Due Diligence Inquiries
If your school board or compliance committee requires completed vendor risk questionnaires regarding our subprocessors:
MyEduOS Vendor Risk & Compliance Team
Email: compliance@myeduos.com
Support Portal: Request Enterprise Security Packet