Subprocessors
When you use Convoup, certain data is processed by third-party services (subprocessors) that help us deliver the platform. This page lists all subprocessors that may process your data, what they do, and where they operate.
Last updated: September 1, 2026
Messaging Platform
Meta Platforms, Inc.
Purpose
WhatsApp Business Platform (Cloud API) — message delivery, template management, webhook events, and Embedded Signup.
Data Processed
Phone numbers, message content, templates, delivery/read statuses, WABA metadata.
Processing Location
United States (default). EU data residency available via Cloud API Local Storage.
Certifications
ISO/IEC 27001, SOC 2 Type II, SOC 3.
Cloud Infrastructure
Supabase Inc.
Purpose
Database hosting, authentication, and real-time subscriptions.
Data Processed
Account data, contacts, conversations, message history, configuration.
Processing Location
United States. EU region available.
Certifications
SOC 2 Type II.
Cloudflare, Inc.
Purpose
CDN, DDoS protection, and TLS termination for convoup.com and app.convoup.com.
Data Processed
HTTPS traffic in transit (no persistent storage of message content).
Processing Location
Global edge network.
Certifications
SOC 2 Type II, ISO 27001.
AI Providers
Groq, Inc.
Purpose
AI-Assisted Support — generates draft replies for human review. Customer content is sent only when a user requests an AI suggestion.
Data Processed
Message content (transient, Zero Data Retention — not stored by Groq after response).
Processing Location
United States.
Certifications
SOC 2 Type II.
Email & Communication
Google LLC (SMTP)
Purpose
Transactional email delivery — account invitations, notifications, and system alerts.
Data Processed
Staff and user email addresses only. No message content.
Processing Location
Google global infrastructure.
Certifications
SOC 2 Type II, ISO 27001.
Payment Processing
Razorpay Software Private Limited
Purpose
Payment processing and subscription management.
Data Processed
Billing name, email, and phone number.
Processing Location
India.
Certifications
PCI DSS compliant.
CI/CD & Backup
GitHub, Inc. (GitHub Actions / GHCR)
Purpose
Continuous integration, deployment, and Docker image hosting.
Data Processed
CI pipeline artifacts and Docker images. No platform data.
Processing Location
United States.
Certifications
SOC 2 Type II.
Cloudflare, Inc. (R2 Storage)
Purpose
Encrypted database backup storage.
Data Processed
Encrypted database backups (contains message and contact data at rest).
Processing Location
Cloudflare global network.
Certifications
SOC 2 Type II.
The AI subprocessor (Groq) processes message content only when a user explicitly requests an AI-generated reply. Content is not used to train models and is not retained after the response is generated (Zero Data Retention).
Meta processes message data as part of the WhatsApp Business Platform. Their data handling is governed by the WhatsApp Business Data Processing Terms.
This list is updated when subprocessors are added or replaced. Customers will be notified of material changes.