Subprocessors
Last updated: 2026-04-28
NILifi engages the following third-party service providers (subprocessors) to deliver our platform. Each subprocessor is bound by a written Data Processing Agreement that requires them to process customer data only on our documented instructions and to maintain security controls equivalent to or stronger than our own.
We will provide notice of new subprocessors at this page at least 30 days before they begin processing customer data. Customers with active institutional contracts may object to a new subprocessor in writing per the terms of their Data Processing Agreement.
Current subprocessors
| Service | Purpose | Data handled | Region |
|---|---|---|---|
| Supabase SOC 2 Type II certified. DPA available via Supabase dashboard. | Authentication, database, file storage, real-time | User accounts, profiles, course progress, quiz attempts, certificates, audit log | AWS US-West (Oregon) |
| Vercel SOC 2 Type II certified. DPA available via Vercel account. | Application hosting and edge networking | Application logs, edge cache, environment variables (secrets at rest) | Global edge; primary compute US-East / US-West |
| GitHub SOC 2 Type II certified. DPA available via GitHub Trust Center. | Source code hosting and CI/CD | Source code, build artifacts, CI logs, repository metadata | United States |
How to be notified of changes
If you have an institutional contract with NILifi, your designated privacy contact will receive email notification. Athletes and parents may also subscribe to changes by emailing privacy@mw-creative.com.