DRAFT prepared for legal review, not a policy.

# Subprocessor list, corrected (draft)

Prepared 2026-09-19. Nothing here is legal advice. The binding list today is the
page at
https://limud.co/subprocessors. That page names Google (Gemini API) as the AI
processor, which was correct when it was written and is no longer the whole
truth: the build now selects its model provider from a single configuration
value and ships three adapters (src/lib/ai-providers/index.ts). This draft is
the correction, for counsel to approve before the published page is changed.

Claude does not edit the published legal pages, which is why this is a separate
file rather than an edit to that one.

## Model providers

| Provider | Purpose | Data sent |
| --- | --- | --- |
| Microsoft Azure AI Foundry | The configured text provider for production: rewriting teaching material, AI tutor replies, suggested grades and feedback, study material. | The teaching material or student answer relevant to the request, plus the derived learning signals. Never a password, a payment detail or a full database record. |
| Google (Gemini API) | The media path: reading an audio recording or a photograph of written work. Also the build's fall-through text provider when no provider is configured. | The recording or image the student submitted, and the assignment context needed to read it. |
| OpenAI | A third adapter that ships in the build and is not selected in production. | Nothing, while it is not selected. |

Limud does not permit any of these providers to train its models on the data we
send it. The exact term relied on differs per provider and is an open item
below.

## Infrastructure

| Provider | Purpose | Data |
| --- | --- | --- |
| Render | Application hosting, Oregon (US West). | All data in transit to and processed by the application. |
| Neon | PostgreSQL database hosting. | All data stored in the Limud database. |
| Stripe | Payment processing for paid subscriptions. | Billing contact information and payment details. Limud does not store full card numbers. |
| Resend | Transactional email: password resets, one-time codes, contact replies. | Recipient email address and the content of the message. |

## Open items for counsel and for the owner

1. Confirm, against the deployed configuration, which text provider is live at
   the moment this list is published. The value is a server environment
   variable and is deliberately not read by this document.
2. Confirm the no-training term relied on for each model provider, since the
   three providers state it differently.
3. Confirm whether an adapter that ships but is not selected belongs on a
   published list at all, or only in this draft.
4. Replace the published page once 1 to 3 are settled, and date it.