Sub-processors
Infrastructure and service providers we use to run Conformant, with the roles they perform.
Conformant uses the providers below to host the application, authenticate users, store workspace data, send email, process payments, and power the Compliance Advisor. Each provider’s data processing terms apply when we use their service — you do not need to sign separate agreements with them. We list them here so your agency knows who may process data under our customer DPA.
Authentication, organization membership, and session management.
United States / EU — SCCs or equivalent safeguards where required.
PostgreSQL database and file storage for workspace data (EU region).
European Union
Subscription billing and payment processing.
United States / EU — SCCs or equivalent safeguards where required.
Transactional email (welcome, reminders, contact confirmations).
United States — SCCs or equivalent safeguards where required.
Compliance Advisor AI inference on sanitized workspace snapshots.
United States — SCCs or equivalent safeguards where required.
Application hosting and edge delivery.
European Union / United States — SCCs or equivalent safeguards where required.
Turnstile bot protection on public contact and support forms.
Global edge network — SCCs or equivalent safeguards where required.
Application error monitoring and performance diagnostics (when enabled).
European Union / United States — SCCs or equivalent safeguards where required.
We may update this list when we add or replace providers. Material changes will be reflected on this page.
Last updated: July 2026
Questions? Get in touch.