{"subprocessors":"# Converight Sub-processor List\n\n**Last updated:** 25 July 2026 · **Applies to:** Converight v1.0.0-beta.1\n**Data processor:** Thinkdata Labs LLP, trading as Converight\n\nThis is one of the two documents most often requested first in a buyer's security\nquestionnaire (PRD §11). It lists every third party that processes, stores, or\ntransmits customer data on behalf of Thinkdata Labs LLP.\n\nUnder GDPR terms: the customer is the **controller** of the data in their\nIntercom workspace; Thinkdata Labs LLP is the **processor**; every party listed\nbelow is a **sub-processor**.\n\nWe will give **30 days' notice** before adding a sub-processor that processes\ncustomer content. To be notified, email `security@converight.com`.\n\n> **TODO before publication.** Fill in the LLP's registered address, registration\n> number, and jurisdiction of incorporation. A buyer's legal team needs a named,\n> addressable entity to put in a DPA — \"Converight\" alone is a trading name, not\n> a counterparty. If you will sell into the EU or UK from outside it, take advice\n> on whether GDPR Art. 27 requires you to appoint a local representative and name\n> them here.\n\n---\n\n## Sub-processors that handle customer content\n\n| Sub-processor | Purpose | Data processed | Location |\n| --- | --- | --- | --- |\n| **Intercom Inc.** | Source system. Converight reads from the customer's own Intercom workspace under a read-only OAuth grant. | Conversations, contacts, companies, tags, articles, admins, teams | Per the customer's own Intercom region (US / EU / AU) |\n| **Amazon Web Services (S3)** | Archive storage. Every archived record is stored encrypted, under Object Lock. | Encrypted record payloads and generated export bundles | Configured region — single region at launch |\n| **_Hosting provider_** (Railway / Render / Fly.io — final selection pending, §17) | Runs the API and worker processes; hosts the managed PostgreSQL and Redis instances. | Metadata, key material (wrapped), job state, audit log. **No archived record content.** | Configured region |\n\n## Sub-processors that do not handle customer content\n\n| Sub-processor | Purpose | Data processed |\n| --- | --- | --- |\n| **Stripe, Inc.** | Subscription billing. | Billing contact, company name, payment details. Payment card data goes directly to Stripe and never touches Converight infrastructure. |\n| **Sentry** (optional; disabled unless a DSN is configured) | Error tracking. | Stack traces and request metadata. Cookies, tokens, and key material are redacted before transmission; archived record content is never sent. |\n| **_Email provider_** (SMTP, final selection pending) | Sign-in links and invitations. | Email addresses and one-time sign-in links. |\n\n---\n\n## What each party can and cannot see\n\n- **Archived conversation content** exists in exactly one place: the S3 archive\n  bucket, encrypted with a per-record data key. AWS holds ciphertext; the keys\n  that decrypt it are wrapped and held in Converight's PostgreSQL database.\n  Neither store is sufficient on its own.\n- **PostgreSQL never stores archived record content.** It stores pointers,\n  checksums, wrapped keys, job state, the audit log, and a deliberately minimal\n  search index (record type, display name or subject, tags, dates, state) — see\n  `data-handling.md` for the exact fields and why they are there.\n- **Converight staff cannot alter or delete an archived object.** S3 Object Lock\n  applies to every principal, including our own administrative accounts.\n\n## Open items\n\nThe hosting provider and email provider are marked pending because they are\nDay-1 provisioning decisions (PRD §18.2) rather than architectural ones. This\ndocument is updated the moment each is selected, before any customer data is\nprocessed.\n"}