We rely on the following sub-processors to operate the platform. Each is bound by its own contractual data-protection terms with us and, where applicable, by GDPR Article 28 data-processing addenda.
Supabase (Supabase Inc., United States): primary application database, authentication, file storage. Hosts user profile, enrollment, exam, certificate, proctoring, and audit-log records. Data is stored in the United States.
Stripe (Stripe, Inc., United States): payment processing for tuition, The 90 Club™ rebate refunds, employer-seat purchases, chargeback handling. Cardholder data flows through Stripe and is not stored by National Course Portal.
Vercel (Vercel Inc., United States): hosting, CDN, serverless function execution, and request logging for the application itself.
Resend (Resend, Inc., United States): transactional email delivery for receipts, certificate notifications, parental-consent confirmations, support replies, and data-rights confirmations.
Google LLC (United States): Google Identity Services for the optional "Sign in with Google" button. We receive only the OpenID Connect claims you authorize at the consent screen (email, profile, name).
If a sub-processor is added, removed, or substantially changed, this list is updated. Existing accounts are notified at the next sign-in when the change materially affects data handling.