Harvest Kernel
Sub-processors
These are the third-party services Harvest Kernel relies on to run the Faculty Toolkit. Each is engaged only to the extent needed to provide the service, and each is bound to data-protection terms no less protective than our own.
Current sub-processors
Anthropic
AI text generation
Powers the toolkit's drafting and generation tools through the Claude API. The text you submit and relevant course context are sent to Anthropic to produce a response, then returned. The toolkit uses a commercial API organization key, and under Anthropic's Commercial Terms, data sent through the API is not used to train Anthropic's models. Inputs and outputs are retained for 30 days under the organization's current data-retention setting and then deleted, except where retention is required by law or to investigate misuse. Anthropic's Zero Data Retention option, under which inputs and outputs are not stored at rest after the response, is offered only to large enterprise customers (a substantial annual commitment plus a safeguards review) and is not in place for Harvest Kernel at this stage. Anthropic publishes a Data Processing Addendum that it incorporates into its commercial terms.
Railway
Hosting, database, and file storage
Hosts the application, the PostgreSQL database, and the persistent file volume where uploads (such as branding logos and syllabus files) are stored. Data is encrypted in transit and at rest. Railway has confirmed in writing that data at rest is encrypted, covering the database, the persistent volume, and automated backups and snapshots on the same encrypted storage layer. Railway holds a SOC 2 Type II attestation, with its report and encryption policy available to an auditor under NDA through its Trust Center.
Resend
Transactional email
Delivers account email such as welcome messages, password resets, quota notices, and any breach or service notifications. Processes recipient email addresses and the contents of those messages for the purpose of delivery.
Sentry
Error monitoring
Captures application errors so we can detect and fix problems. Configured to exclude personal data from error reports.
At a glance
| Sub-processor | Function | Data-handling note |
|---|---|---|
| Anthropic | AI text generation (Claude API) | Commercial API terms; not used to train models; inputs and outputs retained 30 days then deleted; ZDR is enterprise-only and not in place; Anthropic DPA incorporated into its commercial terms. |
| Railway | Hosting, PostgreSQL, file volume | Encryption in transit and at rest both in place; at-rest encryption confirmed in writing (covers database, volume, and backups). Railway SOC 2 Type II. |
| Resend | Transactional email delivery | Processes recipient addresses and message contents to deliver email. |
| Sentry | Error monitoring | Configured to exclude personal data from error reports. |
Notice of changes
Before adding or replacing a sub-processor that processes student data, we will update this page and, for institutions under a Data Processing Agreement, provide notice so the institution can review the change. Questions go to dean@harvestkernel.com.