Sub-processors
To run CentreBloom we rely on a small number of trusted service providers (“sub-processors”) that process data on our behalf. We choose established providers and share only what each needs to do its job. This page lists them, what they do, the information involved, and where they primarily process it.
| Provider | Purpose | Information involved | Processing / storage |
|---|---|---|---|
| Supabase | Primary application database, authentication and file storage | Core application data — children, families, staff, records, documents | Canada (ca-central-1) |
| Stripe | Card payments, subscriptions and staff payouts (PCI-DSS Level 1) | Payment and payout details, billing contact; card numbers are handled by Stripe and never stored by CentreBloom | United States & global |
| Twilio | SMS text reminders — only when a centre enables SMS | Recipient mobile number and the message text | United States & global |
| Email delivery provider | Transactional email — reminders, receipts, invitations, notifications | Recipient name, email address and message content | United States & global |
| OpenAI | Optional features only — generating draft assessment questions, and reading timesheets or calendars submitted in a free-form file | Only the content submitted to that feature — the topic text you enter, or the text extracted from a file you upload. No child records, family details or payment information are sent. | United States |
CentreBloom's primary application database and customer records are hosted in Canada. Some of the supporting services above operate on global infrastructure and may process limited information outside Canada. Processing locations reflect each provider's public documentation at the time of writing and can change; we update this page as our providers change.
Need a data-processing agreement (DPA) or answers to a security questionnaire? Email hello@centrebloom.com. See also our Privacy Policy and Security page.