Who helps us
Sub-processors
Like most software services, Oxonia relies on other companies for some parts of the service. This page names them, says what they do and where, and explains how we tell universities about changes.
About this list
Last updated: 10 October 2026.
A sub-processor is a company that we use to process personal data for a university, where the university is the controller and we are its processor. Each one is bound by a written contract with data protection terms at least as protective as our data processing agreement, and we remain responsible for it.
Which providers apply to a university depends on the products and features it uses and the region in its order form. A provider for a feature the university has not turned on does not receive its data.
AI services
| Company | What it does | Products | Data | Location |
|---|---|---|---|---|
| OpenAI, L.L.C. | AI drafting and answers, speech-to-text transcription, translation, read-aloud voices and search indexing, when the university uses our shared AI service | Scribe, Tutor, Mark, Senate, Nexus and other products' AI features | Text, transcripts, audio for transcription, uploaded images such as exam scripts and slides, prompts and outputs | United States |
| Anthropic, PBC | AI drafting and answers, when selected for a university | Scribe, Tutor, Mark, Senate, Nexus | Text, transcripts, uploaded images such as exam scripts and slides, prompts and outputs. No audio | United States |
We use these providers under business terms that do not allow them to train their models on the data we send by default. They may keep it for a limited period for abuse and safety monitoring under those terms. We do not use customer data to train AI models unless the university agrees in writing.
A university can instead connect its own AI keys for a provider of its choice. That provider then acts under the university's own agreement, not as our sub-processor, and is not listed here. See Bring your own AI keys.
Hosting, messaging and email
| Company | What it does | Products | Data | Location |
|---|---|---|---|---|
| [Hosting provider: legal name] | Application servers, databases and file storage | All products | All Customer Data | [Hosting location] |
| [Transactional email provider: legal name] | Sending invitations, notices and password resets | All products | Names, email addresses, message content | [Email provider location] |
| Twilio Inc. | SMS, and WhatsApp messages in Oxonia Senate, when a university turns them on | Scribe, Senate | Phone numbers and message text, usually a link | United States |
| Meta Platforms (WhatsApp Business Platform) | WhatsApp messages and recordings sent by WhatsApp, when a university turns them on | Scribe | Phone numbers, message text and media | United States and other countries |
| Mailgun Technologies, Inc. or Postmark (ActiveCampaign, LLC) | Receiving recordings that lecturers email to their private upload address, using whichever service is configured | Scribe | Sender email, message and attached recordings | United States |
| Cloudflare, Inc. | Bot protection on the public demo form | Mark | IP address and browser signals | Global network |
Payment providers
| Company | What it does | Used for | Location |
|---|---|---|---|
| Stripe | Card payments and subscriptions | Our billing: subscriptions and AI credit top-ups | United States, Ireland and UK |
| Paystack | Card, bank and mobile money payments in Africa | Student fee payments in Wallet and Advance (through each university's own account); AI credit top-ups | Nigeria and other African countries |
| Flutterwave | Card, bank and mobile money payments in Africa | AI credit top-ups in Oxonia Mark and Nexus | Nigeria and other countries |
| Safaricom PLC (M-Pesa) | M-Pesa mobile money payments in Kenya | AI credit top-ups in Oxonia Mark | Kenya |
Payment providers process card and account details directly. We do not see full card numbers. For much of the payment data they act as independent controllers under their own terms and the rules of card schemes and banking regulators.
Integrations the university chooses
When a university connects its own systems, such as Microsoft 365, Google Workspace, SAML and Shibboleth sign-in, Zoom, Moodle, Canvas, Blackboard or ORCID, data flows between Oxonia and that system under the university's own agreement with its provider. These are not our sub-processors.
International transfers
Several providers are in the United States. Transfers from the UK rely on the UK Extension to the EU-US Data Privacy Framework where the provider is certified, or on the UK International Data Transfer Agreement or Addendum. Transfers from the EU rely on the EU-US Data Privacy Framework or the EU standard contractual clauses. Transfers under other countries' laws follow the regional privacy addenda.
Changes and notice
- We give at least 30 days' notice before a new or replacement sub-processor starts to handle a university's personal data, by email to its named privacy contacts and by updating this page.
- To get notices, email privacy@oxonia.ai with the subject "Sub-processor updates", your institution's name and the contact who should receive them.
- A university may object on reasonable data protection grounds within the notice period. If we cannot resolve the objection, it may end the affected service and receive a refund of prepaid fees for the unused term, as the DPA explains.
- In an emergency, such as a provider failing, we give as much notice as we can and explain why.
Related