Subprocessors.

Loam (operated by Difinity Pty Ltd, ABN 82 686 692 759) uses a deliberately small number of subprocessors to run the Service and separately supports optional identity providers chosen for sign-in. Subprocessors act only on our instructions, are bound by contractual data-protection obligations no less protective than our Data Processing Agreement, and gain no rights to use personal information for their own purposes. Identity providers perform only the sign-in exchange described below. We remain responsible for our subprocessors' performance.

• Amazon Web Services (AWS): cloud hosting, storage and encrypted backups. Data processed: all service data, including student work and evidence records. Processing location: the Institution's selected region (Sydney, Frankfurt or N. Virginia).
• Amazon SES (AWS): transactional email: invitations, password resets, notifications. Data processed: names and email addresses of message recipients. Processing location: the Institution's selected region (Sydney, Frankfurt or N. Virginia).
• AWS Bedrock (AWS): AI comprehension-check processing of submitted student text, an opt-in feature (see below). Data processed: excerpt of a student's own in-progress draft (the last ~600 words), and no more; no direct identifiers. Processing location: the geography of the institution's selected region — within Australia for the Australia region; within the United States for the United States region; and within the European Union, which may include EU member states other than Germany, for the Germany region.
• Stripe (Stripe, Inc. and its affiliates): subscription billing for School-plan institutions: payments, invoices and the billing portal. Data processed: institution billing contacts (name, work email, billing address) and payment-transaction data only, never student data, student accounts or evidence records. Processing location: United States, and Stripe's global processing infrastructure, under Stripe's Data Processing Agreement (stripe.com/legal/dpa).
• PostHog, Inc.: optional analytics and masked session replay on the public marketing website only. Data processed after consent: random anonymous browser ID, event timestamp, query-free public page paths, selected page, section, navigation, CTA, scroll and performance events, broad browser request information, and masked replay. On /security/, replay and generic route events are disabled; PostHog receives only one static page view and coarse sample-download, sample/non-sample selection, and successful sample/author-export verification classifications. It never receives a selected PDF, filename, file metadata, account or author identity, document content, proof identifier, evidence, replay, disclosure level, result or explicit verification duration. Never signed-in application data. Processing location: PostHog Cloud EU, hosted in Frankfurt, Germany.
• Google (Google LLC), as identity provider: sign-in chosen by the user. Data processed: provider name and issuer, the provider's immutable account identifier, provider-supplied name and email, email-verified flag, directory/organisation identifier where a school account is used (Google hd), and sign-in timestamps. The identity information Google returns is then stored in the Institution's selected region (Sydney, Frankfurt or N. Virginia), the same as other account data. Never student work, evidence records, classes or submissions. Processing location: countries in Google's global service infrastructure; exact processing locations are not fixed by Loam and must be confirmed from the applicable agreement.
• Microsoft (Microsoft Corporation), as identity provider: sign-in chosen by the user. Data processed: provider name and issuer, the provider's immutable account identifier, provider-supplied name and email, email-verified flag, directory/organisation identifier where a school account is used (Microsoft tenant ID), and sign-in timestamps. The identity information Microsoft returns is then stored in the Institution's selected region (Sydney, Frankfurt or N. Virginia), the same as other account data. Never student work, evidence records, classes or submissions. Processing location: countries in Microsoft's global service infrastructure; exact processing locations are not fixed by Loam and must be confirmed from the applicable agreement.

Google and Microsoft as identity providers. When a school signs in using its own Google Workspace or Microsoft Entra tenant, the user or Institution initiates that provider's optional sign-in flow. We list Google and Microsoft for transparency because sign-in information is exchanged with them. They are not included in DPA Schedule 3; their role for Loam is limited to authentication. Student writing, evidence records, classes and submissions are never sent to them.

The table lists the third-party service providers that process personal information for Loam. Difinity personnel are covered separately below. Student accounts and evidence records live only with AWS, in the region your institution selected, and are never sent to Stripe, PostHog, Google or Microsoft. Difinity's operations personnel are in Australia. In the Australian operations system they can see only opaque Loam identifiers for the student, teacher, school and support request, together with the name, work email address and support messages of a teacher or school administrator who contacts us. They cannot see or receive a student's name, email address, date of birth, writing, replay, evidence record or other directly identifying student details or student content. Student content and direct student identifiers remain in the institution's selected region. Stripe is engaged solely to bill institutions on the School plan; personal (Free-plan) workspaces have no billing relationship at all, so nothing about a Free-plan educator or their students ever goes to Stripe. PostHog is engaged only for consented activity on the public website. It is not used for analytics or replay behind login. Google and Microsoft, as identity providers, are engaged only for the sign-in exchange described above. The application makes a separate request to load its own feature settings, containing one fixed identifier and no user, tenant, school or document data.

Difinity personnel. Difinity personnel are part of Difinity, not a third-party Subprocessor. They are bound by confidentiality and role-based access controls. Australian operations personnel have only the limited access described above.

PostHog session replays are retained for no more than 30 days. Public-site analytics events and associated metadata are retained for up to 7 years under Loam's current PostHog Cloud plan. Loam may shorten the analytics-event period in future and will update its public notices to match the enforced setting.

AWS Bedrock and the comprehension-check feature. Loam's optional "comprehension check" asks a student one short question about a draft they just wrote, to check understanding rather than to grade or judge. It is off by default for every institution and Free-plan workspace; a school administrator (or, on the Free plan, the educator) must switch it on. When it is on, an excerpt of the student's own in-progress draft (the last ~600 words) is sent to an AWS Bedrock foundation model processing in the same geography as the region you selected for your stored data, together with a fixed instruction. It never leaves that geography: within Australia for the Australia region, within the United States for the United States region, and — for the Germany region — within the European Union, which may include EU member states other than Germany. No student name, email, school, class or assignment identifier is included in that request, and the excerpt is not stored by us for any purpose beyond generating the question. This is inference, not training: we do not use this excerpt, or any other student writing, to train an AI model.

We use no third-party advertising or data-enrichment services, and no student data goes to any third party for such purposes. PostHog's limited public-site analytics role is described above and in our Cookie and Website Analytics Notice. AWS Bedrock, used only as described above, is the sole third-party AI processing in the service.