Who runs the platform.

Conformant uses the providers below to host the application, authenticate users, store workspace data, send email, process payments, and power the Compliance Advisor. Each provider’s data processing terms apply when we use their service — you do not need to sign separate agreements with them. We list them here so your agency knows who may process data under our customer DPA.

• Clerk

  clerk.com

  Authentication, organization membership, and session management.

  United States / EU — SCCs or equivalent safeguards where required.

• Supabase

  supabase.com

  PostgreSQL database and file storage for workspace data (EU region).

  European Union

• Stripe

  stripe.com

  Subscription billing and payment processing.

  United States / EU — SCCs or equivalent safeguards where required.

• Resend

  resend.com

  Transactional email (welcome, reminders, contact confirmations).

  United States — SCCs or equivalent safeguards where required.

• Anthropic

  www.anthropic.com

  Compliance Advisor AI inference on sanitized workspace snapshots.

  United States — SCCs or equivalent safeguards where required.

• Vercel

  vercel.com

  Application hosting and edge delivery.

  European Union / United States — SCCs or equivalent safeguards where required.

• Cloudflare

  www.cloudflare.com

  Turnstile bot protection on public contact and support forms.

  Global edge network — SCCs or equivalent safeguards where required.

• Sentry

  sentry.io

  Application error monitoring and performance diagnostics (when enabled).

  European Union / United States — SCCs or equivalent safeguards where required.

We may update this list when we add or replace providers. Material changes will be reflected on this page.

Data Processing Agreement

Last updated: July 2026