Sub-processor list
Version 1.1 — as of 28 September 2026.
The following list identifies the Sub-processors engaged by andBeyond.digital Ltd, which operates C3NTR, to process School Personal Data on behalf of customer schools. The list forms Annex III of the C3NTR Data Processing Agreement.
| Sub-processor | Role | Location of processing | Transfer mechanism | Engaged since |
|---|---|---|---|---|
| Google LLC / Google Cloud (Firebase) | Authentication (Firebase Auth), database (Cloud Firestore), object storage (Cloud Storage), serverless compute (Cloud Functions), push notifications (Firebase Cloud Messaging), error reporting (Crashlytics), web hosting (Firebase App Hosting). | UK (europe-west2, London) for compute and database; EU (europe-west4, Netherlands) for App Hosting. Crashlytics crash reports and push-notification delivery use Google’s global infrastructure. |
UK adequacy for the EEA region; Google Cloud Data Processing Addendum with the UK International Data Transfer Addendum / EU SCCs for any processing outside the UK/EEA. | Before 10 June 2026 (in place when this list was first published) |
| Stripe Payments Europe Ltd | Payment processing for school subscriptions. C3NTR never stores card details — Stripe is PCI-DSS Level 1 certified and is the controller for card data it receives. | Ireland (EEA). | UK adequacy regulations for the EEA; Stripe DPA. | Before 10 June 2026 (in place when this list was first published) |
| Pexels GmbH | Stock-image and stock-video search results returned via the C3NTR media picker. Pexels receives the search query string; no user identifier is forwarded. | Germany (EEA). | UK adequacy regulations for the EEA. Note: when a leader downloads a chosen image or clip, and when you view a discipline page on this website, your device fetches it from Pexels’ content network directly. | Before 10 June 2026 (in place when this list was first published) |
| Cloudflare, Inc. | Bot protection on the marketing site's public forms (early access and roadmap ideas) using Cloudflare Turnstile. | United States, with EU-region edge handling per Cloudflare's data-protection statement. | Cloudflare DPA incorporating the UK International Data Transfer Addendum / EU SCCs. | Before 10 June 2026 (in place when this list was first published) |
| Anthropic, PBC | Optional AI writing assistant. Used only when a school leader turns the feature on with their own Anthropic API key. Receives the notes the leader chooses to send (topic, bullet points, section or article titles) and the leader’s key, sent straight from the leader’s browser or device; nothing passes through C3NTR, and no member data is sent. Listed for transparency: the provider acts on the leader’s own account, not as C3NTR’s processor. | United States. | UK International Data Transfer Addendum / EU SCCs in Anthropic’s commercial terms. Anthropic acts on the leader’s own account. | Before 10 June 2026 — in use but omitted from the first publication; listed 28 September 2026 |
| OpenAI, L.L.C. | Optional AI writing assistant, as above, when a school leader chooses OpenAI with their own API key. | United States. | UK International Data Transfer Addendum / EU SCCs in OpenAI’s data processing terms. OpenAI acts on the leader’s own account. | Before 10 June 2026 — in use but omitted from the first publication; listed 28 September 2026 |
| Google Workspace (Gmail) — Google LLC | Transactional email sent by C3NTR’s Cloud Functions: billing notices to school leaders, and internal copies of early-access, feedback and template-request submissions (which can include the submitter’s name, phone and email). | Google Workspace, EU/UK data regions where available; Google’s global infrastructure otherwise. | Google Workspace Data Processing Addendum with the UK International Data Transfer Addendum / EU SCCs. | Before 10 June 2026 — in use but omitted from the first publication; listed 28 September 2026 |
Services your device contacts directly (not Sub-processors)
These are not engaged by us to process School Personal Data, but your device connects to them when you use the relevant feature, so they see your IP address: YouTube and Vimeo when a school embeds a video from those services; Pexels when a chosen stock image or clip is downloaded, and on this website’s discipline pages; Google Fonts when the app or web portal loads its typeface; and any website a school leader chooses to import content or branding from.
Changes to this list
28 September 2026 (v1.1): added Anthropic, OpenAI and Google Workspace (Gmail), which were in use before this list was first published on 10 June 2026 but were omitted from it; added the transfer mechanism column; described the services your device contacts directly. We are sorry for the omission. Schools that accepted the DPA before this date may object under clause 5.3 as if this were a notified change.
Change notification
We give 30 days’ prior written notice before adding or replacing a Sub-processor, on this page and by email to school leaders. An email subscription on this page is planned; until then, write to info@c3ntr.app to be added to the notice list.
Objection process
If you object to a proposed Sub-processor change on reasonable data-protection grounds within the 30-day notice window and the parties cannot resolve the objection, you may terminate the affected portion of the Services without penalty, as set out in clause 5.3 of the DPA.