Security and privacy review
Everything a school's IT or privacy office needs to review Pangea Chat, on one page. If you are a teacher, send this page to them.
Documents
Security overview
Compliance standards, content moderation, access controls, and hosting options.
Accessibility Conformance Report
Our self-assessment of the web app against WCAG 2.1 Level AA and Section 508, on the VPAT 2.5 template.
Subprocessors
The third parties that process data on our behalf, what each one does, and the data it receives.
| Subprocessor | Purpose | Data Processed | Location |
|---|---|---|---|
| Amazon Web Services (AWS) | Cloud infrastructure — hosting, compute, storage, databases, networking, monitoring, email delivery (SES) | All Personal Data (at rest and in transit) | US (us-east-1, N. Virginia) |
| Google Cloud | Natural Language API (tokenization, syntax analysis), Speech-to-Text, Text-to-Speech | User message text, user audio recordings, text for speech synthesis | US/Global |
| OpenAI | LLM inference (grammar checking, translation, learning activities, bot chat responses), image generation (DALL-E), speech-to-text (Whisper), text embeddings, content moderation, model fine-tuning | User message text, user audio recordings, activity images, training data derived from user interactions | US |
| Anthropic | LLM inference for learning features (failover/alternative to OpenAI) | User message text | US |
| Deepgram | Speech-to-text transcription | User audio recordings | US |
| Soniox | Speech-to-text transcription | User audio recordings | US |
| Google Firebase Analytics | In-app analytics and event tracking | Matrix user ID, subscription status, behavioral events (login, sign-up, message sent, class creation), screen views | US/Global |
| Google Firebase Cloud Messaging (FCM) | Push notification delivery | Device push tokens, app instance ID, notification content | US/Global |
| Google Analytics 4 (GA4) | Website visitor analytics | Visitor IP addresses (anonymized), cookies, page views, custom events (no authenticated user data) | US/Global |
| Stripe | Payment processing | Subscription and payment data (Processor does not store card details) | US |
| Sentry | Error monitoring and performance tracking | Error context (may include user IDs, request metadata) | US |
| SERPAPI | Image search for learning activities | Search queries (no user Personal Data) | US |
| Pexels | Stock image sourcing for learning content | Search queries (no user Personal Data) | US |
Documents on request
Our Information Security Policy, our completed HECVAT (the higher education security questionnaire) and a Data Processing Agreement are available on request. Choose the ones you need.
Questions about a review? Email support@pangea.chat.