Sub-processor register
Last updated: 16 July 2026
This register lists the third-party providers ("sub-processors") that process data on Congruent's behalf. It is referenced by, and forms part of, the Data Processing Agreement (DPA) we enter into with each client. For the personal data collected through the marketing website only, see the Privacy Policy.
Platform sub-processors — client-engagement data
Used to deliver the diagnostic and Bank-in-a-Box services.
| Sub-processor | Service | Data processed | Location | Safeguard |
|---|---|---|---|---|
| Supabase | Managed Postgres database & authentication | Client account records, pseudonymised survey responses, ingested KPI values | London, UK (EU region) | UK/EU hosting; per-tenant row-level isolation |
| Fly.io | Application compute — API, analytical engine, report worker | Engine aggregates & generated artifacts, in processing / transit | London (lhr), UK | UK hosting |
| Upstash | Managed Redis job queue | Job metadata only (identifiers; no client content) | European Union (region) | EU region; job metadata only, no client content; confirming no non-EU read-replicas before any client data; SCCs where applicable |
| Amazon Web Services | Artifact storage (S3) & survey-invite email (SES) | Generated reports/dashboards; respondent email addresses for invite delivery | eu-west-2 (London) | UK/EU region |
| Vercel | Client portal & web hosting / edge | Authenticated portal sessions & request metadata | Vercel Inc. (US); global edge, EU functions available | DPA; 2021 EU SCCs (2021/914) + UK addendum |
| Anthropic | LLM inference for report drafting & QA | Engine outputs & market context only — raw client records and personal data are excluded by design | United States (primary sub-processor: AWS) | Commercial API — inputs/outputs never train models (not enrolled in the Development Partner Program); organisation data-retention set to 30 days (Zero-Data-Retention available, not currently enabled); SCCs + UK IDTA; a named lead signs off every report |
| Stripe | Billing & payment processing | Billing contact details & payment/transaction metadata | Stripe Payments Europe, Ltd (Ireland); some processing in the US | DPA (within the SSA); SCCs + UK IDTA + EU-US Data Privacy Framework; PCI-DSS Level 1 |
| Sentry | Application error & performance monitoring | Exception/event data & performance traces (request metadata, user/tenant identifiers; no raw client survey/report content) | European Union — Frankfurt data region (vendor Functional Software, Inc. is US-incorporated) | DPA; EU (Frankfurt) data residency; SCCs + UK IDTA; sub-processor change notice via RSS |
| Plaud | Interview capture & transcription — recorded executive interviews (Diagnostic Stage-2 CEO/sponsor and the Bank-in-a-Box add-on) | Interview recordings & AI notes, where recorded — retained in Plaud. The Congruent platform ingests only a role-attributed text summary — no interviewee name and no audio cross into the platform | EU/EEA — AWS Frankfurt (eu-central-1); EU AI endpoints | On Plaud's Team plan. An Article 28 DPA (GDPR/UK GDPR) is in force, incorporated by reference into Plaud's Team Commercial Terms (no separate countersigned document); it incorporates the EU SCCs + UK Addendum and binds Plaud's onward sub-processors. EU/EEA data residency. No model training; user-controlled deletion, full purge on cancellation |
Website sub-processors — marketing site only
Process only the personal data submitted through congruentindex.com (enquiries and bookings). Detail in the Privacy Policy.
| Sub-processor | Service | Location |
|---|---|---|
| HubSpot | CRM, contact forms and meeting scheduling | EU data hosting |
| Vercel | Website hosting and cookieless analytics | EU / global edge |
| Cloudflare | DNS, email routing, and CDN delivery of a charting library on the demo page | Global |
| Calendar and Google Meet for booked calls | EU / global, SCCs | |
| PostHog | Product analytics and optional session replay (consent-gated) | EU-hosted |
International transfers
Where a sub-processor processes data outside the UK/EU, that transfer is covered by appropriate safeguards — UK/EU Standard Contractual Clauses (with the UK International Data Transfer Addendum) or an adequacy decision.
Changes to this register
We keep this list current; the "last updated" date above shows the latest revision. To be notified in advance of a new or replacement sub-processor before it starts processing your data, email hello@congruentindex.com and we will add you to the notification list.
Data Processing Agreement
Congruent's DPA — which incorporates this register — is available to prospective and current clients. Request it at hello@congruentindex.com.