Coursfy uses essential cookies and browser storage to run the site. The optional categories stay off until you switch them on: analytics turns on error monitoring, and marketing and cross-device analytics load nothing today. You can accept all, reject non-essential, or manage each category. AI and voice processing are set in Privacy settings. Privacy Policy · Cookie Policy
Last updated: 21 September 2026
Coursfy uses the following subprocessors to deliver the platform. This list is incorporated by reference into our Data Processing Agreement (DPA) for business customers.
We notify customers of material subprocessor changes per the DPA.
Academies use Coursfy’s managed AI providers. An academy cannot connect its own provider at this time.
| Vendor | Purpose | Data location | Hosting region | Safeguards |
|---|---|---|---|---|
| Stripe | Payments, subscriptions, invoices and payouts to creators (Stripe Connect) | EU and United States | EU and US | Stripe data processing agreement; PCI DSS certified; card numbers never reach Coursfy's servers; standard contractual clauses for transfers |
| Amazon Web Services (Amplify, S3, CloudFront) | Hosting of the website and application servers, storage of files and videos, and delivery of files | EU; CloudFront delivers files from locations worldwide | eu-north-1 (Stockholm) | AWS data processing addendum; encryption in transit and at rest; access limited by role |
| MongoDB Atlas | Application database: accounts, courses, academies, learning progress and purchases | Production region not yet confirmed | Contact privacy@coursfy.com for the confirmed region | MongoDB data processing agreement; encryption in transit and at rest |
| SendGrid (Twilio) | Email: welcome, sign-in and password messages, receipts and notifications | United States | US | Twilio data protection addendum; standard contractual clauses; encryption in transit |
| Twilio | SMS verification codes when a phone number is verified | United States | US | Twilio data protection addendum; standard contractual clauses; encryption in transit |
| Google Firebase | Sign-in with Google or Apple and push notifications in the Coursfy mobile app | United States | US | Google data processing terms; standard contractual clauses |
| OpenAI | AI features (Lumina courses and tutor, academy AI assistant, recommendations) and transcription of speaking exercises | United States | US | OpenAI data processing addendum; standard contractual clauses; API data not used to train models |
| Anthropic (only when enabled) | Writing Lumina courses and tutor answers in place of OpenAI | United States | US | Anthropic's Commercial Terms incorporate its DPA and transfer clauses; applicability depends on the account agreement |
| Sentry (only when enabled) | Error monitoring for the website and servers; in the browser only with analytics consent | EU or United States, depending on the project's data region | EU (Frankfurt) or US | Sentry data processing addendum; email addresses and sign-in tokens removed from reports as far as possible |
| WorkOS (only when enabled) | Single sign-on with Microsoft and organisation logins (SAML and OpenID Connect) | United States | US | WorkOS Terms of Service incorporate its DPA; applicability depends on the account agreement |
| Okta (including Auth0) (only when enabled) | Single sign-on with Google and Okta logins | United States | US | Applicable data-processing and transfer terms depend on the Okta/Auth0 account agreement |
Last updated: 21 September 2026
Coursfy uses the following subprocessors to deliver the platform. This list is incorporated by reference into our Data Processing Agreement (DPA) for business customers.
We notify customers of material subprocessor changes per the DPA.
Academies use Coursfy’s managed AI providers. An academy cannot connect its own provider at this time.
| Vendor | Purpose | Data location | Hosting region | Safeguards |
|---|---|---|---|---|
| Stripe | Payments, subscriptions, invoices and payouts to creators (Stripe Connect) | EU and United States | EU and US | Stripe data processing agreement; PCI DSS certified; card numbers never reach Coursfy's servers; standard contractual clauses for transfers |
| Amazon Web Services (Amplify, S3, CloudFront) | Hosting of the website and application servers, storage of files and videos, and delivery of files | EU; CloudFront delivers files from locations worldwide | eu-north-1 (Stockholm) | AWS data processing addendum; encryption in transit and at rest; access limited by role |
| MongoDB Atlas | Application database: accounts, courses, academies, learning progress and purchases | Production region not yet confirmed | Contact privacy@coursfy.com for the confirmed region | MongoDB data processing agreement; encryption in transit and at rest |
| SendGrid (Twilio) | Email: welcome, sign-in and password messages, receipts and notifications | United States | US | Twilio data protection addendum; standard contractual clauses; encryption in transit |
| Twilio | SMS verification codes when a phone number is verified | United States | US | Twilio data protection addendum; standard contractual clauses; encryption in transit |
| Google Firebase | Sign-in with Google or Apple and push notifications in the Coursfy mobile app | United States | US | Google data processing terms; standard contractual clauses |
| OpenAI | AI features (Lumina courses and tutor, academy AI assistant, recommendations) and transcription of speaking exercises | United States | US | OpenAI data processing addendum; standard contractual clauses; API data not used to train models |
| Anthropic (only when enabled) | Writing Lumina courses and tutor answers in place of OpenAI | United States | US | Anthropic's Commercial Terms incorporate its DPA and transfer clauses; applicability depends on the account agreement |
| Sentry (only when enabled) | Error monitoring for the website and servers; in the browser only with analytics consent | EU or United States, depending on the project's data region | EU (Frankfurt) or US | Sentry data processing addendum; email addresses and sign-in tokens removed from reports as far as possible |
| WorkOS (only when enabled) | Single sign-on with Microsoft and organisation logins (SAML and OpenID Connect) | United States | US | WorkOS Terms of Service incorporate its DPA; applicability depends on the account agreement |
| Okta (including Auth0) (only when enabled) | Single sign-on with Google and Okta logins | United States | US | Applicable data-processing and transfer terms depend on the Okta/Auth0 account agreement |