Third parties andsubprocessors.
Every third party the product calls, what each one receives, and which of them you can switch off.
The rule
No third party receives institutional data unless it is listed here, has terms in place covering that data, and an institution has been told.
Adding one is a change to this document, not a decision made in passing.
Called by the product, on your server
These are outbound requests the software makes from the institution’s own environment. An institution can review or block any of them.
| Third party | Purpose | Institutional or personal data sent |
|---|---|---|
| U.S. Bureau of Labor Statistics | Wage and employment statistics | None. Occupation codes only. |
| U.S. Department of Labor CareerOneStop | Career and wage data | None. Occupation codes only. |
| O*NET (onetcenter.org) | Occupation detail | None. Occupation codes only. |
| Projections Central | State employment projections | None. Occupation and state codes only. |
| Kenii licensing and update service | Entitlement verification, update availability | Site URL and license key. No records. |
| Google Fonts | Web fonts, only when brand fonts are enabled | The visitor’s IP address reaches Google. |
| Microsoft Graph | Optional staff directory sync, configured by the institution | Directory attributes, moved from the institution’s own tenant into its own site. |
| Vimeo, YouTube (nocookie) | Video the institution chooses to embed | The visitor’s request reaches the video host. |
Google Fonts and the video embeds send a site visitor’s request to a third party. Both are optional. An institution that cannot accept that should disable brand fonts and self-host, and avoid third-party video embeds.
Used by Kenii, not by the delivered product
| Third party | Purpose | Institutional data held |
|---|---|---|
| Hosting providers for kenii.app and Kenii’s own services | Running the licensing, update, marketing and evaluation services | Site URL, license key, entitlement state. Evaluation sandboxes hold sample or public catalog content. |
| Source code hosting | Version control for Kenii source | None. |
| Payment processor | Billing institutions | Billing contact and payment details. No academic records. |
Kenii will name the specific providers to any institution that asks, and in an RFP response. They are omitted from a public document only to avoid publishing a target list.
What Kenii does
- Reviews what data a third party would receive before adopting it.
- Prefers government data sources for career information.
- Keeps every optional third party switchable off by the institution.
What Kenii does not yet do
Kenii does not yet run formal security assessments of third parties, and does not hold negotiated breach-liability terms with each one. Kenii operates on those providers’ published terms.
Where an institution requires flow-down terms to a named subprocessor, that is handled in contracting for that institution.
Kenii does not manufacture or supply hardware, so there is no hardware supply chain to manage.
Want theprovider names?
We name every specific provider to any institution that asks, and in an RFP response. They stay off the public page only so this is not a target list.