This is a translation for convenience. Only the German version is legally binding.
Sub-processors
This list names every company allowed to process personal data on CourseKit's behalf (sub-processors under the data processing agreement).
As of: 22/09/2026 · DPA version: 2026-09-27
Vercel Inc.
- Purpose:
- Hosting, serverless functions (Frankfurt region, fra1), file storage (Vercel Blob)
- Location / transfer basis:
- USA; functions configured for Frankfurt, with other processing and backups potentially worldwide – EU-US Data Privacy Framework and Standard Contractual Clauses in Vercel DPA dated 17 March 2026
Neon / Databricks
- Purpose:
- PostgreSQL database
- Location / transfer basis:
- AWS region eu-central-1 (Frankfurt); US provider group – Standard Contractual Clauses and DPA; exact contracting entity to be recorded from the production account
Resend (operated by Plus Five Five, Inc.)
- Purpose:
- Transactional email, in particular sign-in links
- Location / transfer basis:
- USA; primary processing in the USA – EU-US Data Privacy Framework and Standard Contractual Clauses in Resend DPA dated 27 August 2026; customer data deleted within 90 days after termination
BunnyWay d.o.o.
- Purpose:
- Video hosting: storing, processing and delivering uploaded videos
- Location / transfer basis:
- Slovenia; video storage in Germany without an additional replication region, worldwide CDN delivery; anonymised technical stream metrics; DPA available in the Bunny customer account
Functional Software, Inc. (Sentry)
- Purpose:
- Error monitoring: technical error reports from server and browser (page path, browser and system version, technical error trace). Sign-in links, e-mail addresses, cookies and form contents are removed before sending; IP addresses are not stored, only a rough region is derived from the connection
- Location / transfer basis:
- USA; EU data region (Frankfurt) – Standard Contractual Clauses in the Sentry DPA
| Name | Purpose | Location / transfer basis |
|---|---|---|
| Vercel Inc. | Hosting, serverless functions (Frankfurt region, fra1), file storage (Vercel Blob) | USA; functions configured for Frankfurt, with other processing and backups potentially worldwide – EU-US Data Privacy Framework and Standard Contractual Clauses in Vercel DPA dated 17 March 2026 |
| Neon / Databricks | PostgreSQL database | AWS region eu-central-1 (Frankfurt); US provider group – Standard Contractual Clauses and DPA; exact contracting entity to be recorded from the production account |
| Resend (operated by Plus Five Five, Inc.) | Transactional email, in particular sign-in links | USA; primary processing in the USA – EU-US Data Privacy Framework and Standard Contractual Clauses in Resend DPA dated 27 August 2026; customer data deleted within 90 days after termination |
| BunnyWay d.o.o. | Video hosting: storing, processing and delivering uploaded videos | Slovenia; video storage in Germany without an additional replication region, worldwide CDN delivery; anonymised technical stream metrics; DPA available in the Bunny customer account |
| Functional Software, Inc. (Sentry) | Error monitoring: technical error reports from server and browser (page path, browser and system version, technical error trace). Sign-in links, e-mail addresses, cookies and form contents are removed before sending; IP addresses are not stored, only a rough region is derived from the connection | USA; EU data region (Frankfurt) – Standard Contractual Clauses in the Sentry DPA |
Google sign-in is an optional identity service chosen by the person and is not listed here as the customer's sub-processor; CourseKit receives only name, email address and provider identifier and stores no Google tokens. Stripe processes CourseKit billing under its own role allocation with PassionFlow Ltd and receives no member data. Payment providers and video platforms connected by a customer (for example CopeCart, their own Stripe account, Vimeo or YouTube) are the customer's own providers, not CourseKit's.