- Updated
Concertainly subprocessors
Updated: 24 July 2026
The German version is the editorial source. If the versions differ, the German version prevails.
This list contains only direct subprocessors of the Concertainly platform operator. Downstream subprocessors are not duplicated as direct contractual partners; their current linked lists and the agreements actually entered into remain authoritative.
Currently intended services
| Provider | Service and data concerned | Processing location / transfer | Status and evidence |
|---|---|---|---|
| Convex, Inc., 444 De Haro Street, Suite 218, San Francisco, CA 94107, USA | Backend, database, authentication and file features; depending on use, all school, account and audit data stored in Concertainly | Selected deployment region EU West (Ireland). Group, support or subprocessor access may cause third-country transfers; the DPA and Standard Contractual Clauses apply. | direct, active and required; regions, DPA, subprocessors |
| Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA | Hosting, global CDN and server-side web features; connection, request, deployment and technical log data | Global CDN; Vercel states that its primary processing facilities are in the United States. Server-side functions may run in the United States unless configured otherwise. DPA and SCCs apply. | direct, active and required; CDN, regions, DPA |
| Plus Five Five, Inc. (Resend), 2261 Market Street #5039, San Francisco, CA 94114, USA | Transactional email; email address, recipient name, school/concert context, message content and delivery metadata | United States and other locations in the current subprocessor list; the DPA and SCCs apply. Email data is retained for 30 days by default. | direct, active and required; DPA, subprocessors, retention |
| Anthropic Ireland, Limited; Anthropic group including Anthropic, PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA | AI support for work, composer and programme text; under the product rule, no personal student, family or teacher data | EEA and US processing under the contract and subprocessor documents; the DPA and SCCs apply. API input and output is retained for up to 30 days by default; no ZDR agreement applies. | directly integrated and active; DPA, subprocessors, retention |
No additional monitoring provider is currently confirmed as an active direct subprocessor. Before such a service is enabled, this list, the privacy notice and the DPA must be updated.
Change procedure
Concertainly informs contractual partners by email at least five calendar days before adding or replacing a direct subprocessor.
An objection based on reasonable data-protection grounds must be sent within three calendar days after receipt of the notice to tamino.rat@gmail.com. The DPA governs the procedure and consequences.
The list and linked evidence are updated when providers or configurations change. The specific account contracts and current downstream-subprocessor lists remain authoritative.
Effective: 24 July 2026
Last updated: 24 July 2026