Frequently Asked Questions about Subprocessor Notification regarding Confluent
What is Confluent, and why are we adding this as a subprocessor?
- Confluent provides a data streaming and message delivery platform to facilitate secure and efficient data transmission between internal systems. It is a managed Kafka provider operating within AWS infrastructure.
- Confluent Privacy Policy
- Confluent Security
- Confluent Address: 899 West Evelyn, Mountain View, CA 94041, USA.
- EU representative’s contact information is Confluent Germany GmbH c/o Osborne Clarke, Innere Kanalstraße 15, D-50823 Cologne, Germany and may also be reached at privacy@confluent.io.
- United Kingdom representative’s contact information is Confluent Europe Ltd. - EMEA, 1 Bedford Street London WC2E 9HG and may also be reached at privacy@confluent.io.
What products will this affect?
- Confluent will impact all Instructure products that produce or consume data via our central messaging and data platform. This includes any product whose database changes, events, or operational data are published to Kafka today through MSK. Once Confluent is in place, it will become the central message bus for all product data traffic. Specifically, this will include core products such as Canvas LMS, New Quizzes, Catalog, Mastery Connect, Parchment, Studio and other Instructure applications that exchange data between systems or send data to our enterprise data platform (Snowflake). Because Confluent will handle event streams and CDC data from all product databases, it will temporarily contain customer and student data in transit before it is consumed or stored downstream.
What personal data will be collected?
- Confluent will process the same data that flows through our product databases today. This includes any customer, student, or instructor information that is captured in our products and transmitted between systems. Examples include identifiers such as names, email addresses, user IDs, course enrollments, assignment submissions, and other education-related records. Confluent itself does not collect new personal data. It functions as a temporary transport layer, holding messages before they are consumed by other internal systems, such as Snowflake or other Instructure products. No data is stored long-term within Confluent.
Where are the hosting regions?
- Hosting regions will be the same region where the customer is located: Australia, Canada, Germany, Ireland, Singapore and USA.
Will Confluent need to be added to our DPA (Data Processing Addendum)?
The notice we send is Instructure informing all customers per our standard DPA. If you have any questions regarding the DPA, please contact your Customer Success Manager.
Does the vendor have a stated data retention policy?
- Confluent provides the ability to configure data retention, but the retention period is fully controlled by Instructure. The vendor does not impose its own policy on how long data is stored. Data retention will be managed by Instructure, and we plan to maintain a two-week retention window, consistent with our existing configuration in MSK.
Does the vendor provide methods to have data permanently deleted, either through customer action or request?
- No data is persisted beyond the two week retention time. All data will continue to reside in our AWS environment.
When will this effect take place?
- The New Quizzes integration is planned to be fully completed by the end of Q4 2025. Other core products, including Canvas and Catalog, are scheduled to migrate in Q1 2026. Additional products, such as Parchment, will follow later in 2026 as part of a phased rollout.
What data safeguards does Confluent have in place to protect the data being shared?
- Instructure has reviewed Confluent’s security program in accordance with our vendor risk management program
What transfer mechanisms are in place?
- Confluent is listed in the Data Privacy Framework. Data is not stored in Confluent’s environment. All data will continue to reside in our AWS environment.
- Instructure and Confluent have executed a data processing agreement and EU-Standard Contractual Clauses.
