---
title: "Sub-processors"
description: "Third parties that process personal data on behalf of Conphora ApS"
type: "legal"
url: "https://www.conphora.com/sub-processors/"
markdown: "https://www.conphora.com/sub-processors.md"
locale: "en"
language: "en"
updated: "2026-09-22"
author: "Conphora"
publisher: "Conphora"
license: "Free to quote with attribution and a link to the page"
---

# Sub-processors

> Third parties that process personal data on behalf of Conphora ApS

Conphora ApS uses the following sub-processors to deliver conphora.com, Conphora Academy and the Conphora platform. Each acts under a data processing agreement and processes personal data only on our instructions. We inform organisation administrators at least 30 days before adding a sub-processor that will process their data; the DPA sets out the right to object.

### Hosting, storage and application backend

| Sub-processor | Entity, country | Service | Data | Location | Transfer mechanism |
| --- | --- | --- | --- | --- | --- |
| Scaleway | Scaleway SAS, France | Cloud hosting, containers, managed PostgreSQL, object storage, instances, transactional e-mail (notifications from mail.conphora.com) | All application data of the sites, Academy, tools and platform; uploaded documents; help centre support requests, their messages and attachments (object storage); requester name and e-mail address; recipient e-mail address and content of notification and support e-mails | EU (Paris, fr-par) | None needed (EU) |
| Convex | Convex, Inc., USA | Application backend and database (cloud deployments during the transition to self-hosting on Scaleway) | Academy, tools and platform application data; help centre support requests, their messages and attachment records; requester name and e-mail address | EU region (eu-west-1) on Convex Cloud; self-hosted on Scaleway after cutover | EU-U.S. DPF / SCCs |
| Plausible Analytics | Plausible Insights OÜ, Estonia | Cookieless web statistics for conphora.com (website and platform) | Aggregated usage data; no cookies; no personal data retained – IP address and user agent are processed momentarily to count a visit and discarded | EU (Hetzner DE, UpCloud FI, Bunny SI) | None needed (EU) |

### Identity, payments and e-mail

| Sub-processor | Entity, country | Service | Data | Location | Transfer mechanism |
| --- | --- | --- | --- | --- | --- |
| Clerk | Clerk, Inc., USA | Authentication, user and organisation management for the Academy and the platform | E-mail, name, sign-in identifiers, organisation membership, session cookies | USA (with EU data residency option — to be enabled/confirmed) | EU-U.S. DPF / SCCs |
| Stripe | Stripe Payments Europe, Ltd., Ireland | Subscription billing and payments for the platform | Billing contact, invoices, payment method data (held by Stripe) | EU / global | Intra-EU; Stripe's own transfer safeguards |
| Resend | Resend, Inc., USA | Transactional e-mail (internal notifications of Academy enquiries) | Name, e-mail and message content of the enquiry | USA | SCCs (DPF status to confirm) |

### AI and knowledge services

| Sub-processor | Entity, country | Service | Data | Location | Transfer mechanism |
| --- | --- | --- | --- | --- | --- |
| Anthropic | Anthropic, PBC, USA | Large language models (commercial API under Anthropic's Commercial Terms and DPA, zero data retention) for compliance triage, greenwashing analysis, document classification, translation, and draft answers in the support desk | Texts, web-page content and document excerpts submitted for processing, including the text of support enquiries (without the requester's name, e-mail or company); no training on our data | USA (API) | EU-U.S. DPF / SCCs; zero-data-retention terms confirmed 2026-09-22 |
| Voyage AI | Voyage AI Inc., USA | Text embeddings for document search on the platform | Document text excerpts | USA | SCCs (DPF status to confirm) |
| Neo4j Aura | Neo4j, Inc., USA (Aura cloud) | Graph database for product and requirement relationships on the platform | Product data and derived relationships; user identifiers of who created records | EU region (to confirm in the Aura console) | SCCs / DPF |

### Internal operations (no customer personal data)

| Provider | Entity, country | Service | Data |
| --- | --- | --- | --- |
| Tailscale | Tailscale Inc., Canada | Private network for administrative access to Conphora's systems | Conphora staff identities and device metadata only |
| GitHub | GitHub, Inc. (Microsoft), USA | Source code hosting and CI for our software | Source code and commit metadata of Conphora staff and contributors |
| Google Fonts | Google Ireland Ltd., Ireland | Web font delivery on our pages | Visitor IP address when fonts are fetched (no cookies) |

### Changes

| Date | Change |
| --- | --- |
| 2026-09-03 | First published list (draft): Scaleway added as primary hosting; Convex, Clerk, Stripe, Resend, Anthropic, Voyage AI, Neo4j Aura listed; Vercel marked as transitional. |
| 2026-09-11 | Plausible Insights OÜ added (cookieless web statistics, EU); Vercel removed after the production move to Scaleway. |
| 2026-09-13 | First published version. Scaleway row extended with transactional e-mail (notifications); Plausible row corrected to name its three EU providers and the momentary processing of IP address and user agent. |
| 2026-09-22 | Scaleway and Convex rows extended with the help centre's support requests, messages, attachments and requester contact details (Sigrid C6); Anthropic row: the support desk's draft answers run on the commercial API, enquiry text without the requester's identity (Sigrid C1), zero-data-retention terms confirmed; no new sub-processor. |