Back to Trust CenterDownload PDF

AI Sub-Processor Disclosure

Last updated: 2026-04-05

AI Sub-Processor Disclosure

Last updated: 2026-04-05 Owner: StandUp Learning, Inc. ("StandUp") Scope: All AI-powered features (Q&A answers, AI Tutor, CatchUp quizzes, lesson categorization, content moderation, Live Voice Tutor)

StandUp uses third-party large-language-model ("LLM") providers to power its AI features. This document names every AI sub-processor, describes exactly what data is sent to each, states retention policies, and explains how schools can opt out of specific providers.

This document is referenced from the StandUp Data Processing Addendum (DPA) and from the StandUp Trust Center.

Summary

Provider Corporate Entity Purpose PII Sent? Retention (Default) FERPA DPA Signed
Anthropic Anthropic PBC (US) Primary LLM — tutoring, quiz, moderation No Zero (enterprise) Yes
OpenAI OpenAI, L.L.C. (US) Failover LLM — same tasks as primary No 30 days (opt-out) Yes

Both providers are used under enterprise / business agreements that prohibit training on customer data.

1. Anthropic

Provider name: Anthropic Corporate entity: Anthropic PBC, a Delaware public benefit corporation, 548 Market St., San Francisco, CA 94104, USA Role: Primary LLM provider for all StandUp AI features Models used: Claude Haiku (fast tier), Claude Sonnet (standard tier), Claude Opus (premium tier)

Data Sent to Anthropic

StandUp sends to the Anthropic API only the text needed to answer a student's request:

  • Lesson text, lesson summaries, and teacher-uploaded learning materials
  • Student question text (the body of a Q&A post or tutor chat message)
  • Generic role labels ("student", "teacher") — never a real name
  • Conversation history for the current AI Tutor session (text only)

Data NOT Sent to Anthropic

StandUp never transmits any of the following to Anthropic:

  • Student names, usernames, display names, or avatars
  • Email addresses or phone numbers
  • School-assigned student IDs, district IDs, or SIS identifiers
  • IP addresses
  • Date of birth, grade level tied to an individual, or demographic data
  • Parent/guardian contact information
  • Free-text fields that a teacher has marked as containing PII
  • Files that have not been explicitly attached to a lesson or question

PII stripping is performed server-side in the StandUp API layer before the outbound LLM request is issued. See the "PII Stripping" section below for the technical control.

Retention

Anthropic's default API retention is 30 days for abuse monitoring. StandUp operates under Anthropic's Zero Data Retention (ZDR) configuration for enterprise customers, under which Anthropic does not persist prompt or completion content beyond the duration of the API request. StandUp will confirm ZDR status in each school-specific DPA exhibit.

Anthropic does not train its models on data submitted via the API.

FERPA Posture

Anthropic is willing to sign a Data Processing Addendum that includes FERPA School Official designation language for education customers. StandUp's sub-processor agreement with Anthropic incorporates these terms.

Geographic Processing Location

United States (Anthropic API endpoints are hosted on AWS us-east-1 / us-west-2).

Reference Documents

2. OpenAI

Provider name: OpenAI Corporate entity: OpenAI, L.L.C., 3180 18th St., San Francisco, CA 94110, USA Role: Failover LLM provider. StandUp automatically routes requests to OpenAI only when the primary provider (Anthropic) returns a retryable error (5xx, rate limit, overloaded, or network timeout). Models used: gpt-4o-mini (fast tier), gpt-4o (standard / premium tiers)

Data Sent to OpenAI

Same scope as Anthropic — lesson text, question text, conversation history. PII is stripped before the request is issued, using the same control as the Anthropic path.

Data NOT Sent to OpenAI

Same exclusions as Anthropic: no names, emails, IDs, IPs, demographic data, or parent contact information.

Retention

OpenAI's default API retention is 30 days for abuse monitoring. StandUp has requested the Zero Data Retention configuration available to eligible API customers under OpenAI's Business Terms; where ZDR is not yet in effect, data is retained for up to 30 days and then deleted.

OpenAI does not train its models on data submitted via the API under its Business Terms (effective March 1, 2023 and later).

FERPA Posture

OpenAI offers a Data Processing Addendum to Business / Enterprise customers that supports the FERPA School Official exception. StandUp's sub-processor agreement with OpenAI incorporates these terms.

Geographic Processing Location

United States (OpenAI API endpoints hosted on Microsoft Azure, US regions).

Reference Documents

PII Stripping — Technical Control

StandUp treats AI providers as untrusted with respect to student PII. Before any request reaches an LLM provider, the StandUp API layer applies the following control:

  1. No direct identifiers in prompts. Request construction code never reads from the users, students, profiles, parents, or enrollments tables when building an LLM prompt. The only fields permitted in a prompt are lesson content, teacher-uploaded material text, and the literal body of a student message.
  2. Role labels, not identities. Where the model needs to know who is speaking, prompts use generic labels (student:, teacher:) rather than a name.
  3. No metadata leakage. Request payloads do not include HTTP headers, cookies, IP addresses, session tokens, or StandUp database IDs.
  4. Moderation pre-filter. Student-authored text passes through StandUp's moderation layer before being embedded in a tutor prompt; posts flagged as containing identifying personal data are blocked from reaching the LLM until reviewed.
  5. Audit trail. Every outbound LLM call is logged with a hashed request ID, provider name, model tier, and token counts — but not the prompt body — in the StandUp audit log, so a school can confirm volume and routing without exposing student text.

This control is documented in the StandUp Security Document and is testable: any pull request that introduces a PII field into an LLM prompt builder is blocked by code review and by automated checks in CI.

Opt-Out: School-Level Provider Routing

Per StandUp's DPA, a school district may request that its traffic be routed to only a subset of the AI sub-processors named above. For example, a district may require:

  • Anthropic only — all AI features route to Claude; failover to OpenAI is disabled.
  • OpenAI only — all AI features route to GPT-4o; Anthropic is bypassed.
  • Default (both) — primary Anthropic with automatic failover to OpenAI.

How to Opt Out

  1. The school's authorized signer notifies StandUp in writing (email or DPA exhibit) of the allowed providers.
  2. StandUp sets the school's allowed_ai_providers configuration to the requested list.
  3. The routing helper at lib/ai-provider-routing.ts filters the provider chain at request time so that only the allowed providers are ever contacted for that school's traffic.
  4. If none of the allowed providers are available (e.g., Claude is down and OpenAI is not permitted), the request fails closed with a user-facing message — StandUp will not silently fall back to a provider the school has excluded.

Fail-Open Default

A school with no opt-out on file is treated as permitting all named sub-processors (Anthropic + OpenAI). Unknown school IDs also default to "all allowed" to prevent a misconfiguration from breaking the product. An explicit empty list ([]) is honored as "no AI providers allowed" and will disable AI features for that school.

Audit

Every change to a school's allowed_ai_providers list is recorded in StandUp's audit log with a timestamp and the StandUp operator who made the change. Schools may request a copy of their routing history at any time.

Adding New Sub-Processors

StandUp will provide 30 days advance written notice to each school district before adding a new AI sub-processor to this list. During the notice period, the school may object; if StandUp cannot resolve the objection, the school may terminate its subscription without penalty per the DPA.

This commitment is mirrored in the StandUp Data Processing Addendum.

Contact

Questions about this disclosure, PII handling, or provider opt-out should be directed to:

This disclosure is reviewed and updated periodically. The change log is maintained in our internal version control system.

Questions? Email privacy@standuplearn.com