Sub-processors – Conphora

Conphora ApS uses the following sub-processors to deliver conphora.com, Conphora Academy and the Conphora platform. Each acts under a data processing agreement and processes personal data only on our instructions. We inform organisation administrators at least 30 days before adding a sub-processor that will process their data; the DPA sets out the right to object.

Hosting, storage and application backend

Sub-processor	Entity, country	Service	Data	Location	Transfer mechanism
Scaleway	Scaleway SAS, France	Cloud hosting, containers, managed PostgreSQL, object storage, instances, transactional e-mail (notifications from mail.conphora.com)	All application data of the sites, Academy, tools and platform; uploaded documents; help centre support requests, their messages and attachments (object storage); requester name and e-mail address; recipient e-mail address and content of notification and support e-mails	EU (Paris, fr-par)	None needed (EU)
Convex	Convex, Inc., USA	Application backend and database (cloud deployments during the transition to self-hosting on Scaleway)	Academy, tools and platform application data; help centre support requests, their messages and attachment records; requester name and e-mail address	EU region (eu-west-1) on Convex Cloud; self-hosted on Scaleway after cutover	EU-U.S. DPF / SCCs
Plausible Analytics	Plausible Insights OÜ, Estonia	Cookieless web statistics for conphora.com (website and platform)	Aggregated usage data; no cookies; no personal data retained – IP address and user agent are processed momentarily to count a visit and discarded	EU (Hetzner DE, UpCloud FI, Bunny SI)	None needed (EU)

Identity, payments and e-mail

Sub-processor	Entity, country	Service	Data	Location	Transfer mechanism
Clerk	Clerk, Inc., USA	Authentication, user and organisation management for the Academy and the platform	E-mail, name, sign-in identifiers, organisation membership, session cookies	USA (with EU data residency option — to be enabled/confirmed)	EU-U.S. DPF / SCCs
Stripe	Stripe Payments Europe, Ltd., Ireland	Subscription billing and payments for the platform	Billing contact, invoices, payment method data (held by Stripe)	EU / global	Intra-EUStripe’s own transfer safeguards
Resend	Resend, Inc., USA	Transactional e-mail (internal notifications of Academy enquiries)	Name, e-mail and message content of the enquiry	USA	SCCs (DPF status to confirm)

AI and knowledge services

Sub-processor	Entity, country	Service	Data	Location	Transfer mechanism
Anthropic	Anthropic, PBC, USA	Large language models (commercial API under Anthropic’s Commercial Terms and DPA, zero data retention) for compliance triage, greenwashing analysis, document classification, translation, and draft answers in the support desk	Texts, web-page content and document excerpts submitted for processing, including the text of support enquiries (without the requester’s name, e-mail or company); no training on our data	USA (API)	EU-U.S. DPF / SCCszero-data-retention terms confirmed 2026-09-22
Voyage AI	Voyage AI Inc., USA	Text embeddings for document search on the platform	Document text excerpts	USA	SCCs (DPF status to confirm)
Neo4j Aura	Neo4j, Inc., USA (Aura cloud)	Graph database for product and requirement relationships on the platform	Product data and derived relationships; user identifiers of who created records	EU region (to confirm in the Aura console)	SCCs / DPF

Internal operations (no customer personal data)

Provider	Entity, country	Service	Data
Tailscale	Tailscale Inc., Canada	Private network for administrative access to Conphora’s systems	Conphora staff identities and device metadata only
GitHub	GitHub, Inc. (Microsoft), USA	Source code hosting and CI for our software	Source code and commit metadata of Conphora staff and contributors
Google Fonts	Google Ireland Ltd., Ireland	Web font delivery on our pages	Visitor IP address when fonts are fetched (no cookies)

Changes

Date	Change
2026-09-03	First published list (draft): Scaleway added as primary hosting; Convex, Clerk, Stripe, Resend, Anthropic, Voyage AI, Neo4j Aura listed; Vercel marked as transitional.
2026-09-11	Plausible Insights OÜ added (cookieless web statistics, EU); Vercel removed after the production move to Scaleway.
2026-09-13	First published version. Scaleway row extended with transactional e-mail (notifications); Plausible row corrected to name its three EU providers and the momentary processing of IP address and user agent.
2026-09-22	Scaleway and Convex rows extended with the help centre’s support requests, messages, attachments and requester contact details (Sigrid C6); Anthropic row: the support desk’s draft answers run on the commercial API, enquiry text without the requester’s identity (Sigrid C1), zero-data-retention terms confirmed; no new sub-processor.