Data Storage and Sub-Processors
Category: Data & Privacy Reading time: ~3 min
Overview
TheraScripts uses a small set of carefully selected third-party infrastructure providers (sub-processors) to store and process data. This article explains who they are, what they handle, and what certifications they hold.
Where your data is stored
TheraScripts uses two primary infrastructure providers:
Convex (database and server logic)
- Role: Stores your workspace data — scripts, client profiles, session records, workspace settings
- Location: Data is stored in secure cloud infrastructure. Convex maintains EU/UK data residency options; our configuration prioritises UK/EU data location
- Certification: SOC 2 Type II
Clerk (authentication)
- Role: Manages account credentials, login sessions, and identity
- Location: Clerk operates with US data centres and EU data centres. Our configuration uses EU data processing where available
- Certification: SOC 2 Type II
Payment sub-processor
Polar (billing and subscriptions)
- Role: Processes subscription payments, manages billing records, issues receipts
- Data held: Subscription status, payment history. Card data is tokenised and held by Polar's payment network (not TheraScripts)
- Certification: PCI DSS compliant
AI processing
Script generation involves sending a non-identifying session snapshot to an AI model for processing. See AI training and data use for full details on what is sent, retention, and training use.
Sub-processor list
A current sub-processor list is maintained and available on request. If your organisation requires a formal sub-processor register for data protection compliance purposes, contact us at the address in the Privacy Policy.
Data transfers outside the UK
Where data is processed by sub-processors outside the UK, we rely on Standard Contractual Clauses (SCCs) and UK International Data Transfer Agreements (IDTAs) as the legal basis for the transfer. Our Data Processing Agreement includes the relevant transfer mechanisms.