Service Providers

CASFolio runs on a short list of providers. This page is the subprocessor list referenced by the CASFolio Data Processing Agreement, and it is the version schools can cite in a review.

Who processes data, and for what

• Supabase — Authentication, application database, and private file storage. Account details, portfolio records, reflections, evidence files, class membership, coordinator comments.
• Vercel — Application hosting and delivery. Aggregated analytics on the public marketing home page only. Request and delivery data. No authenticated page, API, export, or shared portfolio is measured.
• Resend — Transactional and service email. Email address and message content for sign-in, notification, and service messages.
• Cloudflare R2 — Encrypted off-site backups where configured. Encrypted copies of the database and stored files.

Hosting locations

Each provider’s hosting region is confirmed in writing in the school’s Security and Information Management Schedule, together with the transfer mechanism that applies to that school. CASFolio does not state a region on this page that it has not confirmed for the school reading it.

Changes to this list

CASFolio gives schools at least 30 days’ notice before a planned new provider handles school data, where that is practicable, and works in good faith on a reasonable objection. Each change to this page gets a new version and effective date.

What no provider is allowed to do

No provider receives school or student records to sell, rent, advertise against, build behavioural profiles from, or train AI models with. Providers act on CASFolio’s instructions to run, secure, support, and back up the service.

Change history

Version 2026-09-14 publishes the provider list previously held only in the school review package.