Who else touches your data.

How this list is maintained

It is generated from the same register the application itself runs on, not written by hand alongside it. A vendor appears here when Folio is configured to use it and disappears when it isn’t — which is why a service can be marked feature-dependent: it only ever sees data if you use the feature it powers, such as class recordings or transcription.

Where a vendor’s processing region is pinned by our configuration we say so. Everywhere else the honest answer is the applicable data processing agreement, so that is what it says — we don’t name a region because a vendor happens to offer one. Each row links to the vendor’s own policy, which is always the authority on what it does with what it receives.

Your rights over this data — export, deletion, and what we will never do with your writing — are in the privacy policy. Institutions can pull the same register, plus live retention and audit facts, from their own compliance page, and a DPA is available on request.

What this list is not

Nobody on this page gets your work to keep.

These are the services that make Folio run — hosting, storage, payments, email. None of them are data buyers, advertising networks, or model trainers: we do not sell your data, and your writing is not used to train anyone’s model. Analytics is off until you turn it on, and it never carries document content.