Congruent ← Trust & security
Sub-processor register

Sub-processor register

Last updated: 16 July 2026

This register lists the third-party providers ("sub-processors") that process data on Congruent's behalf. It is referenced by, and forms part of, the Data Processing Agreement (DPA) we enter into with each client. For the personal data collected through the marketing website only, see the Privacy Policy.

During a paid engagement, raw client records and personal data stay inside your environment. Only pre-calculated KPI values and pseudonymised survey responses cross into the Congruent platform, and the analytical engine — not AI — computes every score. The sub-processors below process that engagement data under their own data-protection terms.

Platform sub-processors — client-engagement data

Used to deliver the diagnostic and Bank-in-a-Box services.

Sub-processorServiceData processedLocationSafeguard
SupabaseManaged Postgres database & authenticationClient account records, pseudonymised survey responses, ingested KPI valuesLondon, UK (EU region)UK/EU hosting; per-tenant row-level isolation
Fly.ioApplication compute — API, analytical engine, report workerEngine aggregates & generated artifacts, in processing / transitLondon (lhr), UKUK hosting
UpstashManaged Redis job queueJob metadata only (identifiers; no client content)European Union (region)EU region; job metadata only, no client content; confirming no non-EU read-replicas before any client data; SCCs where applicable
Amazon Web ServicesArtifact storage (S3) & survey-invite email (SES)Generated reports/dashboards; respondent email addresses for invite deliveryeu-west-2 (London)UK/EU region
VercelClient portal & web hosting / edgeAuthenticated portal sessions & request metadataVercel Inc. (US); global edge, EU functions availableDPA; 2021 EU SCCs (2021/914) + UK addendum
AnthropicLLM inference for report drafting & QAEngine outputs & market context only — raw client records and personal data are excluded by designUnited States (primary sub-processor: AWS)Commercial API — inputs/outputs never train models (not enrolled in the Development Partner Program); organisation data-retention set to 30 days (Zero-Data-Retention available, not currently enabled); SCCs + UK IDTA; a named lead signs off every report
StripeBilling & payment processingBilling contact details & payment/transaction metadataStripe Payments Europe, Ltd (Ireland); some processing in the USDPA (within the SSA); SCCs + UK IDTA + EU-US Data Privacy Framework; PCI-DSS Level 1
SentryApplication error & performance monitoringException/event data & performance traces (request metadata, user/tenant identifiers; no raw client survey/report content)European Union — Frankfurt data region (vendor Functional Software, Inc. is US-incorporated)DPA; EU (Frankfurt) data residency; SCCs + UK IDTA; sub-processor change notice via RSS
PlaudInterview capture & transcription — recorded executive interviews (Diagnostic Stage-2 CEO/sponsor and the Bank-in-a-Box add-on)Interview recordings & AI notes, where recorded — retained in Plaud. The Congruent platform ingests only a role-attributed text summary — no interviewee name and no audio cross into the platformEU/EEA — AWS Frankfurt (eu-central-1); EU AI endpointsOn Plaud's Team plan. An Article 28 DPA (GDPR/UK GDPR) is in force, incorporated by reference into Plaud's Team Commercial Terms (no separate countersigned document); it incorporates the EU SCCs + UK Addendum and binds Plaud's onward sub-processors. EU/EEA data residency. No model training; user-controlled deletion, full purge on cancellation

Website sub-processors — marketing site only

Process only the personal data submitted through congruentindex.com (enquiries and bookings). Detail in the Privacy Policy.

Sub-processorServiceLocation
HubSpotCRM, contact forms and meeting schedulingEU data hosting
VercelWebsite hosting and cookieless analyticsEU / global edge
CloudflareDNS, email routing, and CDN delivery of a charting library on the demo pageGlobal
GoogleCalendar and Google Meet for booked callsEU / global, SCCs
PostHogProduct analytics and optional session replay (consent-gated)EU-hosted

International transfers

Where a sub-processor processes data outside the UK/EU, that transfer is covered by appropriate safeguards — UK/EU Standard Contractual Clauses (with the UK International Data Transfer Addendum) or an adequacy decision.

Changes to this register

We keep this list current; the "last updated" date above shows the latest revision. To be notified in advance of a new or replacement sub-processor before it starts processing your data, email hello@congruentindex.com and we will add you to the notification list.

Data Processing Agreement

Congruent's DPA — which incorporates this register — is available to prospective and current clients. Request it at hello@congruentindex.com.