Documentation

Create an account, then choose Connect your Intercom workspace. You are sent to Intercom to authorise the app; the exact permissions requested are shown to you beforehand and again by Intercom itself.

A full backup starts the moment you connect — nothing waits for a schedule. Large workspaces take a few minutes, and the dashboard updates as it progresses. After that, an incremental sync runs daily.

Converight requests five permissions. Every one is read-only.

• Read conversations — the archive itself, including full message transcripts.
• Read and list users and companies — who each conversation was with, and how an erasure request is resolved to affected records.
• Read tags — part of the record as it existed, and how Legal Holds and retention rules are scoped.
• Read and List articles — help-centre articles change over time; archiving them shows what a customer was shown on a given date.
• Read admins — teammate attribution in transcripts, without which a record has no chain of custody. This also covers teams.

There is no write, delete or messaging permission. Converight cannot modify anything in your Intercom workspace.

Conversations and every message part, contacts, companies, tags, help-centre articles, admins and teams. Each record is stored as a complete copy rather than a summary — the transcript is the artifact you will produce for an auditor, so metadata alone would not be worth keeping.

Where Intercom returns only part of a very long thread, the archived record is marked as incomplete rather than presented as whole. A transcript that looks complete but is not is worse than one labelled honestly.

Records are written under S3 Object Lock in GOVERNANCE mode for the retention period you set, 365 days by default. During that period the object cannot be altered or deleted by anyone, including us.

Changing the retention setting applies to records archived from that point on. Records already written keep the retain-until date they were locked with — Object Lock does not permit shortening it.

A hold excludes matching records from every deletion path at once: retention expiry, erasure requests, and post-cancellation purge alike. You can place a hold on a single conversation, on a contact and all their conversations, on a company, or on the whole workspace.

Placing and releasing a hold is recorded in the audit log with the reason you give, which is usually the thing a court or regulator actually asks to see.

When a request actually arrives, the order of operations matters more than the steps — see producing records for a legal request.

These two obligations appear to contradict each other: retention says the record cannot be deleted, and Article 17 says a person may require it to be. Any archive that takes immutability seriously runs into this.

Converight resolves it by destroying the record’s encryption key rather than the record. Each record is sealed with its own key; destroy that key and the ciphertext is unreadable by anyone, permanently, while the object stays locked exactly as retention requires. Both obligations are satisfied at once.

Records under an active Legal Hold are preserved and reported back to you as held, rather than being silently skipped — so a conflict between a hold and an erasure request is surfaced rather than hidden.

The archive is searchable by customer, subject, tag or date. Any record can be exported as PDF or JSON with a manifest of checksums, so a recipient can verify nothing changed after export.

Every backup run and every human view, search, export and download is written to an append-only audit log. Each entry is hashed together with the hash of its predecessor, so verifying the chain proves no entry has been altered, removed or reordered. The database rejects updates and deletes on that table outright.

Disconnecting stops backups and destroys the stored access token immediately. Your archive is retained for the documented period and then crypto-shredded; reconnecting within that window restores it intact.

Uninstalling the app in Intercom revokes our access. Converight detects the revoked token on its next sync and disconnects the workspace itself, so access ends whether or not the uninstall notification reaches us.

• Sub-processor list — every third party that touches customer data, and what each can see.
• Data handling — exactly which fields are stored where, and why.
• Privacy Policy and Terms of Service.

Questions a security review has not answered: security@converight.com.