Our Sub-processors
Version 2.0 · Effective date 15 September 2026
Top Marks AI Ltd ("Top Marks") uses the third-party providers listed below to deliver the Top Marks platform. This list is maintained in accordance with paragraph 8 of Schedule 1 (Data Processing Agreement) to the Platform Terms and Conditions (topmarks.ai/terms). Top Marks gives Customers at least 30 days' written notice before engaging a new sub-processor to process Personal Data or materially changing an existing sub-processor's role, and records each change in the change log in section 3.
1. Sub-processors that process Personal Data on behalf of Customers
The following providers process Personal Data (student and staff data) as Top Marks' sub-processors. All of this processing takes place in the United Kingdom or the European Economic Area, so no international transfer safeguard is required.
| Sub-processor | Role | Personal Data processed | Hosting location |
| Render | Application hosting for the Platform's web application and processing servers | All Customer Data processed by the Platform | Frankfurt, Germany (EU) |
| MongoDB (MongoDB Atlas, deployed on AWS) | Primary database and automated backups | All Customer Data stored by the Platform | Ireland (EU) |
| Amazon Web Services | Temporary storage of uploaded scripts and generated exports (Amazon S3); underlying infrastructure for the MongoDB Atlas database; and, for schools using the Exam Decoder service, hosting of the orchestration service that matches handwritten scripts to student records | Uploaded assessment files, transcriptions and exports; for Exam Decoder schools, the data used to match scripts to students | Ireland (EU) |
| Google Cloud Platform | Compute infrastructure for Top Marks' self-managed OCR transcription service. In the standard flow, scripts carry an anonymising QR code or barcode and are anonymised before transcription. For schools using the Exam Decoder service, the OCR reads uploaded scripts that may contain personal data, such as a student's handwritten name, so that scripts can be matched to student records | Uploaded scripts and their transcriptions; for Exam Decoder schools, including student names written on scripts | London, United Kingdom |
| Amplitude | Product analytics | Usage data and account identifiers of Authorised Users | EU data centre, Frankfurt, Germany |
| Brevo | Service and account email delivery to Authorised Users | Staff names and email addresses | France (EU) |
MIS integration (Wonde): Wonde is engaged by the school, not by Top Marks. The school's data manager authorises, in Wonde's portal, which student and staff records Wonde makes available to Top Marks, and can withdraw that authorisation at any time. Wonde therefore acts as the school's own processor and is not a Top Marks sub-processor; it is mentioned here for transparency because it forms part of the data flow into the Platform.
2. Providers that receive anonymised assessment content only
The following providers receive assessment content only after student identity has been separated from it and incidental identifiers have been removed (see paragraph 3.1(d) of Annex A to Schedule 1). They do not process Personal Data on behalf of Customers and are listed for transparency. Each is engaged on business terms under which customer content is not used to train the provider's models.
| Provider | Role | Hosting location |
| Portkey | AI gateway that routes anonymised content to the model providers below, with load balancing and failover | United States |
| OpenAI | Large language model inference for marking and feedback | United States |
| Anthropic | Large language model inference for marking and feedback | United States |
| Google (Vertex AI and the Gemini API, paid tier) | Large language model inference for marking and feedback | United States |
| Amazon Web Services (Amazon Bedrock) | Large language model inference for marking and feedback | United States |
| Together AI | Large language model inference for marking and feedback | United States |
| GPTZero | AI-generated text detection on anonymised assessment content | United States |
3. Change log
| Version | Date | Change |
| 2.0 | 15 September 2026 | List restructured to show each provider's role, the data it processes and its hosting location. Google Cloud Platform's role described (compute for Top Marks' self-managed OCR transcription service, London). Google Cloud Platform's and Amazon Web Services' roles extended for the Exam Decoder service (OCR of scripts that may contain student names, London; script- to-student matching orchestrator, Ireland), applying only to schools using that service; paragraph 8 notice given 15/09/2026. Brevo's classification corrected: Brevo has delivered account and service emails to Authorised Users, and therefore processes staff names and email addresses; it was previously listed as not processing Personal Data. Aporia and Patronus removed (no longer used). Wonde moved out of the sub-processor table and described as the school's own MIS integration provider. Providers that receive anonymised content only are now listed separately with their roles. |
Document information
| Document title | Sub-Processors |
| Version | 2.0 |
| Effective date | 15 September 2026 |
| Owner | Alex Chapman, COO, Top Marks AI Ltd |
| Review date | August 2027 |
| Published at | topmarks.ai/subprocessors |
| Company number | 11580241 |
We use cookies for analytics and marketing to improve your experience — these are only set if you accept. Decline and we'll only use cookies that are strictly necessary. (Live chat is always available either way.) Learn more in our Cookie Policy.