Legal · Sub-processor register
Sub-processor register
Last updated 2026-08-05. Conversico Ltd will notify practices at least 30 days before adding or replacing a sub-processor so they can object before changes take effect, per the customer Data Processing Addendum.
This register describes product routes and the evidence required before use. It does not claim that every listed provider is engaged for every practice. The signed workspace launch pack is the source of truth for the providers actually enabled for that customer.
How to read provider status
- Required route
- Part of the relevant hosted architecture, but still effective only when the workspace activation and evidence conditions in the register are met.
- Conditional
- Used only when the named feature or provider route is selected for a workspace. No universal engagement is asserted.
- Planned
- Disclosed for roadmap transparency. It must not be treated as currently engaged until the workspace evidence pack records activation.
Provider status register
“Effective scope” states when a route can apply. “Evidence status” states what must be recorded before the public listing can be relied on for a live workspace.
| Vendor | Status | Service | Region | Effective scope | Required mechanism | Evidence status |
|---|---|---|---|---|---|---|
| Twilio Ireland Ltd | Required route | Telephony, SMS, call-recording capture | EEA (Ireland) with UK fallback | When the workspace telephony or SMS route is activated | Required where applicable: UK Addendum + SCCs | Workspace terms and routing evidence required before live traffic |
| ElevenLabs Ltd | Required route | Voice synthesis + conversational-AI inference | United States (no-PII transcript controls applied) | When the Greeta voice-agent route is activated | Required: UK Addendum + SCCs | Workspace terms, transfer evidence, and no-training control required |
| Anthropic, PBC | Conditional | Claude LLM inference (no-training contractual control) | United States | Only when Claude inference is enabled for the workspace workflow | Required: UK Addendum + SCCs | No current workspace engagement is asserted by this public register |
| Microsoft Ireland Operations Ltd | Required route | Azure compute, storage, secrets, monitoring (UK South) | United Kingdom | Backend and data-plane target; effective only after deployment evidence | Within UK / adequacy basis recorded in launch pack | Target is not treated as deployed or attested until signed evidence is recorded |
| Vercel Inc. | Required route | Frontend hosting + edge delivery for app.conversico.com | Global edge with London (lhr1) origin | Public site and hosted practice-dashboard delivery | Required where applicable: UK Addendum + SCCs | Workspace or service evidence pack must record the applicable terms |
| Clerk Inc. | Required route | Workforce identity (practice users only; not patient data) | United States | When hosted workforce sign-in is enabled; excludes local demo authentication | Required: UK Addendum + SCCs | Identity route and transfer evidence required before hosted user access |
| Stripe Payments Europe Ltd | Conditional | Billing + card processing (practice subscriptions only) | EEA (Ireland) | Only when the practice subscription is billed through Stripe | Adequacy basis recorded in launch pack | No patient-call content; engagement is workspace-specific |
| Functional Software, Inc. (Sentry) | Conditional | Error monitoring + replay (PII scrubbed before transmission) | United States | Only when production monitoring is configured for the workspace surface | Required: UK Addendum + SCCs | Scrubbing controls and transfer evidence required before activation |
| PostHog Inc. | Conditional | Product analytics + rollout controls (EU instance) | European Union (Frankfurt) | Only for configured product analytics; public-site analytics also requires consent | EEA / adequacy basis recorded in launch pack | Configuration and consent scope must be recorded before collection |
| Upstash Inc. | Conditional | Redis Serverless cache, rate-limit state, live-feed pub/sub, worker heartbeat state, and Copilot staged-write TTLs under ADR-012 | European Union (Frankfurt) | When a managed Redis runtime route is enabled | Required: UK Addendum + SCCs | Runtime configuration and applicable transfer terms required before activation |
| ilert GmbH | Planned | On-call paging + incident notifications | European Union (Frankfurt) | Future on-call route; no current production engagement asserted | EEA / adequacy basis recorded before engagement | Not to be treated as engaged until the evidence pack records activation |
| Plain Systems Ltd | Planned | Customer support inbox | Provider region to be recorded before activation | Future in-app support channel; email support does not assert this provider is engaged | Applicable processing and transfer terms required before engagement | No current production engagement asserted |
| Instatus Inc. | Planned | Public status-page subscriber notifications | Provider region to be recorded before activation | Only if a public status page and subscriber notifications are launched | Applicable processing and transfer terms required before engagement | No public status service or current production engagement asserted here |
| Braintrust Data | Planned | AI evaluation pipeline | Provider region to be recorded before activation | Only after trace-redaction and no-PII controls are validated | Applicable processing and transfer terms required before engagement | No current production engagement asserted |
| Resend Inc. | Conditional | Transactional email primary route | United States | Only when the email channel selects Resend for that workspace | Required: DPA + UK Addendum | Provider selection and terms required before live delivery |
| ActiveCampaign LLC (Postmark) | Conditional | Transactional email secondary route | United States | Only when a configured email workflow selects Postmark | Required: DPA + UK Addendum | Provider selection and terms required before live delivery |
| 360dialog GmbH | Conditional | WhatsApp Business solution provider | European Union | Only when a practice opts in to and configures the WhatsApp channel | EU GDPR processor terms and applicable UK transfer basis | Channel activation and terms required before live messaging |
How transfers work
Where a sub-processor must process personal data outside the UK, each customer launch pack must record a UK-approved transfer mechanism — the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or an adequacy regulation — supported by a transfer risk assessment for the workspace. The customer Data Processing Addendum is completed during onboarding and sets out the full mechanism for each transfer used by the live service.
Notice of changes
Material changes to this register are communicated via:
- A revision to this page (with the "Last updated" date incremented), and
- An email to the practice owner's registered address at least 30 days before the change takes effect.
Practices may object to a proposed change by emailing the data protection contact named in the privacy policy.