Last updated: April 23, 2026
DegreeOS uses the following sub-processors to deliver its service. All are bound by written data processing agreements (DPAs) incorporating GDPR Standard Contractual Clauses where applicable. Email privacy@degreeos.ai to request advance notice of new sub-processors.
United States
Purpose: Merit AI advisor and practice question generation (Claude API)
Processor under GDPR Art. 28; service provider under CCPA. 30-day data retention. No model training on your data.
United States (AWS us-east-1)
Purpose: Database, storage, authentication
United States
Purpose: Application hosting and edge compute
United States
Purpose: Payment processing and subscription management
Retains payment records for 5–7 years per tax/AML requirements.
United States
Purpose: Transactional and lifecycle email delivery
United States
Purpose: Product analytics (first-party, self-hosted or cloud)
IP addresses are truncated before storage. No cross-site tracking.