Converight Standard Transfer Assessment
Public summary · Version 1.1 · Assessment date 12 September 2026 Owner: Thinkdata Labs LLP · Current outcome: pending
This page is a summary. The detailed assessment is not published, for the reason given at the end.
What it is
An assessment of Converight's standard international processing architecture, written to support a customer's own assessment under Clause 14 of the EU SCCs, Chapter V of the EU GDPR, and the UK transfer risk assessment requirement.
It does not replace the exporting customer's assessment of its own processing. We give you the facts of our architecture and our analysis of the destination. Whether your transfer may proceed is your decision as controller.
Scope
Converight's standard B2B support-archive service.
Special-category data is neither requested nor filtered. It may appear incidentally in support conversations, and the assessment is written on that basis.
It reaches no sector-specific conclusion for routine regulated or sensitive datasets. A customer expecting healthcare, children's, financial-account, criminal-offence or systematically special-category data is outside this assessment and is routed to an individual review before connecting.
Transfer routes
| Route | Parties | Mechanism |
|---|---|---|
| Customer → Converight | Customer (EEA/UK) → Thinkdata Labs LLP, India | Pending the Article 3 and counsel conclusion |
| Encrypted archive → AWS | Thinkdata Labs LLP → Amazon Web Services India Private Limited (India to India); onward infrastructure Amazon Data Services, Inc., Northern Virginia | AWS DPA and processor-to-processor SCCs |
| Search index → Render | Thinkdata Labs LLP (India) → Render Services, Inc. (United States) | EU-US Data Privacy Framework where available; Module Three SCCs as fallback |
| Transactional mail → Amazon SES | Thinkdata Labs LLP → Amazon Web Services India Private Limited; AWS us-east-1 |
AWS DPA and processor-to-processor SCCs |
The archive and the search index are separate transfer categories. They share the customer-to-Converight leg and diverge after it — different recipient, different format, different safeguard. Archive content is encrypted per record; search-index fields are in application-level plaintext.
Current outcome
Pending. Counsel's conclusion on Article 3(2), the India and United States destination-law analysis, and any required supplementary measures are outstanding.
While the outcome is pending, Converight does not connect a workspace whose processing involves a Restricted Transfer. This is enforced by the application, not by policy: the outcome is held in code, and the connection is refused before a customer is asked to adopt anything.
The outcome will be one of proceed, proceed_with_controls or stop. A
stop conclusion blocks activation exactly as firmly as a pending one.
Review date
Reviewed when any of these changes, and in any case within 12 months of the assessment date: the sub-processors or their contracting entities, the processing locations, the technical safeguards, the transfer mechanisms relied on, or the destination-law position.
An adoption never outranks the assessment it adopted. A material version change or an adverse outcome invalidates a previous adoption.
The Customer Adoption Record
A customer in transfer scope adopts this assessment before connecting, and the record captures the legal entity, accepting user, timestamp, document version, the responses given and any disclosed deviations. Completed records are private to the customer and stored against their account.
A blank sample is available on request.
Requesting the detailed assessment
The detailed assessment is not published. It describes root key custody, administrative access, authentication status, control gaps, vendor dependencies and legal-risk conclusions — an accurate description of where a determined attacker would start.
Publishing it would be a worse decision than any of the gaps it records.
It is available to customers and prospective customers through procurement,
under NDA, from privacy@converight.com.