- Updated
Concertainly subprocessors
Updated: 2 September 2026
The German version is the editorial source. If the versions differ, the German version prevails.
This list contains only direct subprocessors of the Concertainly platform operator. Downstream subprocessors are not duplicated as direct contractual partners; their current linked lists and the agreements actually entered into remain authoritative.
Currently intended services
| Provider | Service and data concerned | Processing location / transfer | Status and evidence |
|---|---|---|---|
| Convex, Inc., 444 De Haro Street, Suite 218, San Francisco, CA 94107, USA | Backend, database, authentication and file features; depending on use, all school, account and audit data stored in Concertainly | Selected deployment region EU West (Ireland). Group, support or subprocessor access may cause third-country transfers; the DPA and Standard Contractual Clauses apply. | direct, active and required; regions, DPA, subprocessors |
| Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA | Hosting, global CDN and server-side web features; connection, request, deployment and technical log data | Global CDN; Vercel states that its primary processing facilities are in the United States. Server-side functions may run in the United States unless configured otherwise. DPA and SCCs apply. | direct, active and required; CDN, regions, DPA |
| Plus Five Five, Inc. (Resend), 2261 Market Street #5039, San Francisco, CA 94114, USA | Transactional email and school-initiated circulars to concert participants; email address, recipient name, school/concert context, message content and delivery metadata | United States and other locations in the current subprocessor list; the DPA and SCCs apply. Email data is retained for 30 days by default. | direct, active and required; DPA, subprocessors, retention |
| Polar Software, Inc., USA | Billing for one-time concert licences; organisation name, billing email, language, technical school ID and provider customer, checkout, product and order data. Polar collects billing, tax and payment data directly in checkout. | United States and other locations described by Polar. Polar acts as controller and merchant of record for buyer checkout; for covered data processed on our behalf, Polar's DPA and transfer safeguards apply. | direct, active and required for paid licences; buyer terms, privacy, DPA, subprocessors |
| Anthropic Ireland, Limited; Anthropic group including Anthropic, PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA | AI support for work, composer and programme text; under the product rule, no personal student, family or teacher data | EEA and US processing under the contract and subprocessor documents; the DPA and SCCs apply. API input and output is retained for up to 30 days by default; no ZDR agreement applies. | directly integrated and active; DPA, subprocessors, retention |
| Functional Software, Inc. (Sentry), 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA | Error and stability monitoring for the web application; error type, message, stack trace, the requested route in parameterised form including the school identifier, release, environment, browser and device type, plus an anonymous session count per page view. Cookies, headers, account data, form input and query parameters are removed before transmission; access links are masked in address fields, breadcrumbs and error messages. No IP addresses are transmitted within the event. | Selected data region EU (Frankfurt, Germany); data at rest remains in the EU. Group, support or subprocessor access may trigger third-country transfers; the DPA and SCCs apply. | direct, active and required for operation; EU region, DPA, subprocessors, privacy |
Error monitoring has been active since 2 September 2026. It is configured so that content and contact data are not transmitted deliberately: the provider receives the error type, the error message, the stack trace and the requested route in parameterised form. Access links sent to families by email are masked before transmission; click and console breadcrumbs are discarded. An error message may nevertheless contain a value written into it by the failing code; such residual transmission cannot be ruled out entirely.
Change procedure
Concertainly informs contractual partners by email at least five calendar days before adding or replacing a direct subprocessor.
An objection based on reasonable data-protection grounds must be sent within three calendar days after receipt of the notice to tamino.rat@gmail.com. The DPA governs the procedure and consequences.
The list and linked evidence are updated when providers or configurations change. The specific account contracts and current downstream-subprocessor lists remain authoritative.
Effective: 2 September 2026
Last updated: 2 September 2026