Samio
← Home
Sub-processors

Sub-processors

Last updated: July 8, 2026

Samio Learning, operated by Geekcow Creative Studio, uses a small set of sub-processors to deliver "Samio for Schools". Schools acting as data controllers can review this list to audit the third parties involved. It is kept in sync with the Data Processing Agreement (Bijlage 1 §7) and the sub-processor list returned by our privacy-policy API.
We notify schools in advance of any material change to this list. Sub-processors handling personal data are bound by equivalent data-processing terms.

Current sub-processors

- MongoDB, Inc. (Atlas) — United States (EU region available) — Database hosting (encrypted at rest) - Redis Ltd. — United States / EU — Rate limiting, caching, queues (no persistent PII) - Mailjet SAS (Sinch) — France (EU) — Transactional email (staff email + names) - PayPal (Europe) S.à r.l. — Luxembourg (EU) — Payment processing (school billing data, not student data) - Backblaze, Inc. (B2) — United States — Audio-file storage (no personal data) - DeepSeek — AI content generation (exercise prompts; no student PII) - Google LLC (reCAPTCHA / OAuth) — United States — Bot protection / optional SSO - Microsoft Corp. (Azure AD) — United States / EU — Optional SSO - Kennisnet (Entree Federatie) — Netherlands — Optional Dutch-education SSO

How we keep this current

This page mirrors the authoritative list in the DPA and the sub-processor list our API returns to the privacy-policy page. When a sub-processor is added, removed, or changed in a way that affects the processing of personal data, we notify affected schools in advance so they can raise any objection.

US (FERPA) schools

For schools whose compliance regime is FERPA (United States), the Dutch-education integrations — Kennisnet (Entree Federatie) and Edu-V — are not used; they are specific to the Netherlands. US-school data is handled under the U.S. School Official Agreement, with the sub-processors above that apply to the US market.