Third-Party Processor Inventory

Owner: Platform / Compliance Lane: R4.5 (COPPA / VPC product-flow + PII processor cleanup) Last reviewed: 2026-08-28 (SEC-01 pass — corrected the Upstash row's What we send cell, which still claimed RAW CLIENT IP ADDRESSES "on most routes" and that base-handler imports rate-limit-key ZERO times. Both were true when written on 2026-08-08 and FALSE after b2392165 (2026-08-24): BaseApiHandler now imports the module and digests every identifier before any limiter call, verified at source and against the live production key shape (32-hex digest, scope-prefixed since 3623d683). The stale cell over-disclosed — a reviewer would have re-fixed a closed bug or mis-scoped a deletion request off it. Prior review 2026-08-23, SENTINEL — corrected the Upstash row's Retention and Deletion API / SLA columns, which still described only the counter keyspace and therefore contradicted this same row's own "What we send" cell about the never-expiring analytics keyspace. Verified in the same pass, against production Sentry telemetry, that purge-audit-logs and purge-error-logs now run daily and return ok:true — CRON_SECRET was set in Vercel Production ~2026-08-21, so the pre-08-21 statements that "no purge job has ever run" are stale. Prior review 2026-08-06, SENTINEL F-1/F-2 — corrected the Upstash and Vercel Analytics rows; BOTH were inaccurate at the time of review, describing controls that did not match the code. Prior review 2026-05-24, CRIT-3 reconciliation.)

This document is the authoritative list of every third-party processor that touches AI Safety Adventures user data. It is referenced from the privacy policy (R4.6) and from docs/SECURITY-ACCEPTED-TRADEOFFS.md. Update this file whenever a processor is added, removed, or its data scope changes.

The 2025 COPPA Rule (90 FR 16977, Apr. 22, 2025; compliance deadline Apr. 22, 2026) requires that parents consenting to data collection have access to a clear list of every operator and service-provider that may receive their child's data. This file IS that list.

What we mean by "kid data"

For COPPA purposes, "kid data" = any datum tied to a kid_account row or its student_token_id. Specifically:

• kid_accounts.username (a machine-generated handle; pseudonymous, not anonymous — a first-party persistent identifier is personal information under 16 CFR §312.2(7). This line said "anonymous handle, not PII by COPPA's definition" until 2026-08-28, contradicting the privacy page's own corrected language; SENTINEL caught it in the SEC-01 gate.)
• kid_accounts.credential_hash (never sent to processors in plaintext)
• student_tokens.id (universal player identity — sent to processors as a sha256 prefix or full UUID depending on the processor)
• gameplay events (XP, packs, scenario progress) tied to a student_token

Adult parent PII (parent_accounts.email, parent_accounts.password_hash) is NOT kid data but is governed by the same disclosure requirements.

Processor matrix

DPA TODO list

The following processors need a DPA renewal / first-time signature verified before launch. R4.10 / R4.13 close blocks on this list.

• Sentry — confirm DPA effective date in Sentry org settings
• Resend — verify DPA on file at resend.com/legal
• Upstash — verify DPA on file at upstash.com/legal
• Stripe — confirm DPA effective date for AI Safety Adventures account
• Neon — verify DPA on file at neon.tech/legal

These are date-confirmation items, not "we don't have a DPA" items. Each processor publishes a standard COPPA-compatible DPA; we just need the date persisted for audit purposes.

Data-deletion fan-out (R4.13)

When a parent deletes their account or revokes consent, the following fan-out runs in lib/coppa/data-deletion.ts:

1. DB cascade — kid_accounts, student_tokens, parent_link_requests, gameplay tables (xp, packs, etc.) all cascade-delete via FK ON DELETE CASCADE. SLA: synchronous.
2. Sentry — purge events tagged with studentId via the issues API. SLA: queued + completes within 30 days.
3. Resend — purge logs by recipient_hash (sha256 of normalized email). SLA: queued + completes within 30 days.
4. Vercel logs — file a support ticket. Manual SLA: 30 days, documented in privacy notice.
5. GitHub Actions — n/a (no artifacts retained per R0.1).
6. Upstash — the rate-limit COUNTER keys are TTL'd. CORRECTED 2026-08-08: "no explicit purge needed" is false. The limiter previously ran with analytics: true, and @upstash/core-analytics never calls expire/pexpire, so the usage record — which contains raw client IPs — accumulated with no TTL. analytics: false shipped 2026-08-08 (grep analytics: in lib/api/rate-limiter.ts), which stops NEW writes but deletes nothing. The sets already written are still there and still have no expiry, so a purge is still required. Key shape: @upstash/ratelimit:<requests>:<window>:events:<hourBucket>, one key per hour per limiter config — and the purge must ALSO cover the legacy flat prefix @upstash/ratelimit:events:*, which is where everything written before the per-route namespacing (v2i-59) lives. SCAN MATCH "@upstash/ratelimit*events:*" covers both. See WQ-UPSTASH-ANALYTICS-RETAINS-RAW-CHILD-IPS.
7. Stripe — kids never have Stripe records; teacher record stays per teacher's own deletion request.
8. Neon — point-in-time backup retention is 7 days; the deletion propagates to backup snapshots within that window.
9. Google / Microsoft OAuth — revoking the OAuth grant on the IDP side is the user's responsibility; we documenting the path in the privacy notice.

Total worst-case SLA for full kid-data-trace deletion: 30 days from parent revoke event to confirmation.

Re-evaluation triggers

• Any new processor added to the stack → add a row above + run a privacy policy refresh in the same PR.
• Any processor's retention period changes upstream → update the row + flag in docs/SECURITY-ACCEPTED-TRADEOFFS.md if SLA shifts.
• A future COPPA Rule amendment from FTC → audit the entire matrix for conformance.
• Annual review at the launch anniversary (calendar event recommended).