To operate the Conduit lead intake and qualification platform, we engage a small number of third-party service providers ("sub-processors"). Each processes personal data only to the extent needed to provide its service, and each is bound by a data processing agreement (or equivalent contractual terms) with obligations no less protective than those in our own Privacy Policy.
This page is the canonical, current list. We will update it before onboarding any new sub-processor that handles personal data. Under the India DPDP Act 2023, the deploying client is the data fiduciary; Conduit and the providers below act as processors / sub-processors.
| Sub-processor | Purpose | Data Processed | Location / Notes |
|---|---|---|---|
| Supabase | Database & hosting (PostgreSQL) | All lead PII, conversation history, scoring & billing records | Primary region: Mumbai/Singapore for India data. DPA in place. |
| Twilio | WhatsApp Business messaging | Phone number, message content | DPA in place. Per-tenant subaccount isolation. |
| Anthropic (Claude) | AI email parsing & conversation agent | Email content, conversation messages, lead fields | Commercial terms with zero-data-retention. DPA required for EU data. |
| Meta | WhatsApp Business Platform & Lead Ads | Lead form submissions, WhatsApp delivery metadata | Governed by Meta Business Terms & WhatsApp Business policy. |
| Razorpay | Payments — India (Conduit is seller of record; 18% GST) | Billing contact, GSTIN, subscription & payment metadata | India. Razorpay merchant agreement & DPA. |
| Dodo Payments | Payments — international (merchant of record) | Billing contact, subscription & payment metadata | Dodo is the legal seller for non-India transactions and remits its own destination-country tax. |
| SendGrid / Postmark | Inbound & outbound email | Email content routed to the tenant lead-forwarding address | Inbound-parse provider for leads+{tenant}@in.conduit.app. Per-vendor DPA. |
Hosting for the application layer (Railway / Render / Vercel) processes only application logs and no persistent lead PII. Each provider operates under its own data processing addendum.
We update this page whenever we add, remove, or replace a sub-processor that handles personal data. Customers with a signed Data Processing Agreement may request advance notice of material changes as set out in that agreement. Questions: see the Privacy Policy for our contact details.