Sub-processors

Markable uses a small number of third-party services to operate the platform. This page lists every one that may process personal data on our behalf, what they do, and where they process it. It is the list referred to in Annex I of our School Data Processing Agreement. Where this page and that Annex differ, the Annex in the signed agreement governs. We give customers at least 30 days' written notice before adding or replacing any sub-processor that processes personal data.

Sub-processor list — version 1.1, current as at 15 September 2026.

This page is the list referred to in Annex I of the Markable School Data Processing Agreement. Markable gives at least 30 days' written notice before adding or replacing a sub-processor that processes personal data, as set out in section 7 of that agreement. This page is updated when that notice is given. Changes are recorded below with the date each took effect.

Sub-processor	Purpose	Data processed	Location
Supabase	Database, authentication and file storage	All account and script data, including uploaded student work	United Kingdom (London). Company incorporated in Delaware, USA
Anthropic	AI analysis of student work against mark schemes	The content of a pupil's work, sent for analysis and returned; not stored by Anthropic and not used to train models. Where Markable holds the pupil's name, it is replaced with their initials before the work is sent. For a scanned or handwritten script analysed as an image, that replacement is not possible. Anything else a pupil has written into their own work is sent as supplied. Section 8 of the Data Processing Agreement governs.	United States
Vercel	Application hosting and delivery	Request data and technical logs	Functions execute in the United Kingdom (London). Static assets are served from a global edge network. Company incorporated in the United States.
Resend	Sending account emails such as password resets and confirmations	Email addresses and message content	European Union (Ireland)
Sentry	Error monitoring and diagnostics	Technical error data, which may include IP addresses and account identifiers	European Union (Germany)
Stripe	Subscription payments	Billing details and payment records. No pupil data	United States and European Union
Inngest	Background job scheduling for script analysis	Job metadata and record identifiers. No content	United States
HighLevel (LeadConnector)	Marketing, enquiries and demo bookings	Contact details provided by enquirers	United States
Microsoft 365	Business email (support@markable.uk)	Support correspondence	European Union and United Kingdom
Browser speech recognition (Google or Apple, depending on the browser)	Voice-to-text on the marking page	Audio recorded while a teacher dictates, which may include anything they say about a pupil. Markable does not receive or store the audio; only the transcribed text is saved	United States

Where your data is stored

Student work and all account data are stored in the United Kingdom. Script content is sent to Anthropic in the United States for analysis and is not retained by them for training. Other sub-processors handle limited operational data as described above.

Transfers outside the UK rely on UK adequacy regulations, the UK International Data Transfer Agreement, or EU Standard Contractual Clauses with the UK Addendum, as applicable. A transfer risk assessment is available on request.

Change history

Date	Version	Change
11 September 2026	1.0	List placed under version control. This table records changes from this date forward.
15 September 2026	1.1	Browser speech recognition (Google or Apple) added. It was already declared in Annex I of the School Data Processing Agreement and in the Privacy Policy, and was missing from this page only. No sub-processor was added to the service, removed or replaced; this corrects an omission from the published list.
11 September 2026	1.0	Anthropic entry rewritten to match section 8 of the Data Processing Agreement. It previously asserted a safeguard the agreement does not claim; it now states the mechanism and the case in which it does not apply. Vercel location corrected: functions execute in the United Kingdom. Supabase's place of incorporation, and the statements that Stripe receives no pupil data and Inngest no content, added from Annex I. No sub-processor was added, removed or replaced.