Sub-processors

To deliver the Zentrum24 Academy compliance-training platform, we engage a limited number of trusted third-party service providers, known as "sub-processors." A sub-processor is an organization we authorize to process personal data on our behalf, under our instructions, in order to provide part of the service (for example, cloud hosting, database storage, transactional email, or payment processing). Each sub-processor is engaged under a written data-processing agreement that requires it to protect personal data to a standard consistent with our commitments to customers and with applicable data-protection law, including the EU GDPR and UK GDPR.

Zentrum24 LLC remains responsible to its customers for the performance of its sub-processors. We maintain this page as the current, authoritative list of sub-processors that may process customer personal data.

Our commitment to notify you of changes

We are committed to transparency about who processes personal data on our behalf. Before we engage a new sub-processor, or replace an existing one, in a way that may process customer personal data, we will update this page and, where you have subscribed to change notifications, provide advance notice. This gives customers a reasonable opportunity to review the change and, where a data-processing agreement provides a right to object, to raise a reasonable, good-faith objection on data-protection grounds. Details of any objection process and notice periods are set out in the applicable data-processing agreement. We give at least thirty (30) days’ notice before a new sub-processor starts processing Customer Data.

Current sub-processors

Name	Purpose	Data processed	Location
Vercel Inc.	Application hosting and content delivery for the Zentrum24 Academy web application, including TLS termination and serverless request handling on Vercel's managed platform.	Application-tier processing of request traffic that may contain account, user, training-record, and audit data in transit; persistent data at rest is stored by Supabase (below).	the United States (AWS us-east-1 (Northern Virginia, United States)).
Stripe, Inc.	Payment processing and subscription billing for paid plans.	Billing and subscription data, including customer/organization billing contact details, plan and subscription identifiers, and payment/transaction metadata. Card and payment-instrument details are collected and stored directly by Stripe; Zentrum24 Academy does not store full payment-card numbers.	United States.
Supabase	Managed PostgreSQL database and private, encrypted object storage for all persistent Service data.	All persistent Service data: customer account data (org name, plan); user personal data (full name, email, optional employee ID); training records (assignments, completions, scores, e-signatures, certificates); and audit/security logs (IP address, user agent, timestamps).	United States. Processing takes place in the United States (AWS us-east-1 (Northern Virginia, United States)).
Email / SMTP provider (not yet selected)	Delivery of transactional email (for example, account, verification, and notification messages). The specific provider has not yet been selected and will be identified here before launch.	Email delivery data: recipient email address, and the sender, subject, and content of transactional emails, plus related delivery metadata.	United States. Processing takes place in the United States (AWS us-east-1 (Northern Virginia, United States)).

Note on the email/SMTP provider. The transactional email/SMTP provider has not yet been finalized; it will be identified in this list before launch. Until then, no third-party email sub-processor is engaged. Where required by applicable law, transfers of personal data outside your region are protected by an appropriate transfer mechanism, such as the EU Standard Contractual Clauses and, where applicable, the UK International Data Transfer Addendum.

How to subscribe to change notifications

To receive advance notice when we add or replace a sub-processor, subscribe to sub-processor change notifications by emailing contact@zentrum24.com with the subject line "Subscribe — Sub-processor updates," and include your organization name and a contact email address. You may unsubscribe at any time by emailing the same address with the subject line "Unsubscribe." Questions about this list or our data-processing practices can be directed to our privacy contact at contact@zentrum24.com.

Last updated: 8 September 2026. Zentrum24 LLC, 1621 Central Ave, Cheyenne, Wyoming 82001, USA. Governing law: State of Wyoming, USA.