Subprocessors
Last reviewed 31 August 2026
This page lists the third-party service providers (subprocessors) Accrue ABA uses to operate and support the platform. It is maintained by the Accrue ABA team and is updated when the subprocessor list changes.
Where a fact about a subprocessor has not been confirmed in writing by that vendor, this page says “Not yet independently verified” rather than stating an assumption. Hosting region, data processing agreement availability, retention periods, and onward-transfer guarantees are only stated here when they can be confirmed from Accrue's own configuration or from an executed agreement.
Review schedule
- Last reviewed: 31 August 2026
- Next calendar-year review: 31 August 2027
- Next Illinois State fiscal-year review: 30 June 2027 (end of Illinois State fiscal year 2027)
Current subprocessors
Lovable
- Purpose
- Application hosting, serverless functions, secrets management, and provisioning/administration of the managed database, storage, and authentication services. Accrue contracts directly with Lovable.
- Data categories
- All application data, including student records; application and error logs; staff account data.
- Student covered information
- Yes — may be processed
- Hosting / processing region
- Not yet independently verified
- Required or optional
- Required
- Last reviewed
- 31 August 2026
Supabase
- Purpose
- The managed Postgres database, object storage, and authentication platform underneath Lovable Cloud. Accrue does not hold a separate, independent Supabase contract; the project is provisioned and administered through Lovable.
- Data categories
- All application data at rest, including student records, uploaded documents, and authentication credentials.
- Student covered information
- Yes — may be processed
- Hosting / processing region
- United States (US West, Oregon) for the production database
- Required or optional
- Required
- Last reviewed
- 31 August 2026
Amazon Web Services (AWS)
- Purpose
- Underlying cloud compute and storage on which the managed database, object storage, and authentication services run. Reached as a sub-subprocessor through Lovable and Supabase.
- Data categories
- Encrypted storage and compute for all application data, including student records.
- Student covered information
- Yes — may be processed
- Hosting / processing region
- United States (US West, Oregon), inherited from the database region
- Required or optional
- Required
- Last reviewed
- 31 August 2026
Cloudflare
- Purpose
- DNS, TLS termination, content delivery, and edge request routing for accrueaba.com and the application runtime.
- Data categories
- Request metadata in transit: IP address, user agent, requested URL. URLs can contain internal record identifiers but never student names.
- Student covered information
- Possible — may be processed
- Hosting / processing region
- Global edge network; Not yet independently verified for specific points of presence
- Required or optional
- Required
- Last reviewed
- 31 August 2026
Lovable managed email
- Purpose
- Authentication and transactional email delivery from the configured sender domain (notify.accrueaba.com), including SPF/DKIM, bounce and complaint processing.
- Data categories
- Recipient email address, staff or guardian name where included, and message content. Reminder emails use student alias codes, not names.
- Student covered information
- Possible — may be processed
- Hosting / processing region
- Not yet independently verified
- Required or optional
- Required
- Last reviewed
- 31 August 2026
Lovable AI Gateway
- Purpose
- Routes optional AI-assisted drafting requests (clinical note drafting, IEP goal import, curriculum import) to a model provider.
- Data categories
- Pseudonymous context only: goal titles, behavior counts, trial accuracy, session metadata, and text an authorized user pastes or uploads for import.
- Student covered information
- Possible — may be processed
- Hosting / processing region
- Not yet independently verified
- Required or optional
- Optional — an organization administrator can turn AI features off entirely
- Last reviewed
- 31 August 2026
OpenAI
- Purpose
- The model provider currently configured behind the Lovable AI Gateway for Accrue's AI-assisted drafting features (model identifier openai/gpt-5.6-sol, read from the application configuration).
- Data categories
- The same pseudonymous context passed through the gateway. Accrue's own retention and training terms with OpenAI are held by Lovable, not by Accrue directly.
- Student covered information
- Possible — may be processed
- Hosting / processing region
- Not yet independently verified
- Required or optional
- Optional — not used when AI features are turned off for the organization
- Last reviewed
- 31 August 2026
Google (Firebase Cloud Messaging)
- Purpose
- Delivers browser push notifications to Chrome and other Chromium-based browsers using the standard Web Push protocol. Accrue integrates no Firebase SDK; the browser vendor selects this endpoint.
- Data categories
- Encrypted push payload and the browser-issued push endpoint. Push messages contain no student names, alias codes, or clinical content.
- Student covered information
- No — may be processed
- Hosting / processing region
- Not yet independently verified
- Required or optional
- Optional — only when a user enables notifications in a Chromium browser
- Last reviewed
- 31 August 2026
Mozilla (autopush)
- Purpose
- Delivers browser push notifications to Firefox using the standard Web Push protocol.
- Data categories
- Encrypted push payload and the browser-issued push endpoint. Push messages contain no student names, alias codes, or clinical content.
- Student covered information
- No — may be processed
- Hosting / processing region
- Not yet independently verified
- Required or optional
- Optional — only when a user enables notifications in Firefox
- Last reviewed
- 31 August 2026
Apple (Apple Push Notification service)
- Purpose
- Delivers browser push notifications to Safari and iOS home-screen installs using the standard Web Push protocol.
- Data categories
- Encrypted push payload and the browser-issued push endpoint. Push messages contain no student names, alias codes, or clinical content.
- Student covered information
- No — may be processed
- Hosting / processing region
- Not yet independently verified
- Required or optional
- Optional — only when a user enables notifications in Safari or on iOS
- Last reviewed
- 31 August 2026
Paddle
- Purpose
- Subscription billing, checkout, tax, invoicing, and merchant-of-record services.
- Data categories
- Billing contact name, billing email, and payment details handled entirely by Paddle. Accrue never stores card numbers. No student data is sent to Paddle.
- Student covered information
- No — may be processed
- Hosting / processing region
- Not yet independently verified
- Required or optional
- Optional — not used by organizations on an invoiced or beta agreement
- Last reviewed
- 31 August 2026
Google (Sign in with Google / OAuth)
- Purpose
- Optional single sign-on for staff accounts, brokered through Lovable.
- Data categories
- Staff email address, name, and profile picture URL from the Google account used to sign in. No student data.
- Student covered information
- No — may be processed
- Hosting / processing region
- Not yet independently verified
- Required or optional
- Optional — staff may use email and password instead
- Last reviewed
- 31 August 2026
What this list does not claim
Accrue does not have visibility into how each vendor's own personnel access their infrastructure. Any assurance about vendor staff access, vendor subprocessors, vendor retention, or vendor certifications must come from that vendor's own agreements and audit reports, not from this page.
Changes to this list
We will notify organization administrators of material changes to this subprocessor list through the email address associated with the organization and, when practical, through an in-app notice.
Questions
For subprocessor, data processing, or school-agreement questions, contact your organization administrator or see the Security & Compliance page.