Roles
You are the data controller; Eduba is the data processor. The DPA forms part of your subscription agreement.
Sub-processors
See the Subprocessors list. We notify you 30 days before adding new sub-processors.
Security measures
Encryption in transit and at rest, access reviews, audit logging, and incident response per our Security page.