How to read this directory
Technical configuration checked 15 October 2026 without reading customer records or publishing keys. Configured does not mean every function has passed a live operational test. Optional integrations are not automatically active for every customer.
The directory distinguishes Procora processors, other recipients and optional connections. It is not a signed DPA, a complete account-specific contract register or a certification. Obtain the applicable agreements for your actual information before activation.
Source: Hetzner privacy
Hetzner — application hosting
Purpose: server operation for the application, PostgreSQL and Redis. Current server metadata reports hel1-dc2 and eu-central, in the Helsinki area of Finland. This describes the checked application server; it does not establish every backup, provider support access or downstream processing location.
Depending on the service, operation includes account, conversation, enquiry and audit information. Customer instructions, access, retention and the applicable hosting agreement must match the processing. An EU data centre does not guarantee EU-only processing by every recipient.
OpenAI and OpenCode — different model paths
OpenAI access is configured for the assistant processing path, including answers and relevant knowledge processing where used. OpenCode is enabled in the audit model configuration as a gateway. A stored key or enabled setting does not prove a successful model run.
The model receives necessary messages, prompts and relevant knowledge excerpts. Audit recommendations use bounded public evidence; report email and private report keys are excluded from that model input. A gateway’s selected model can involve another downstream provider. Model selection and actual usage are recorded with the relevant run where available.
There is no universal promise of no training, zero retention or EU residency across all models. These depend on the actual provider, model, account and agreement. Establish the terms before allowing confidential material or personal information in a new use case.
Resend and Stripe — email and payments
Resend access is configured for email paths, including audit-report delivery. Necessary information can include recipient address, delivery content and status. A private report link in an email is not a public report or proof of inbox delivery. Owned support mailboxes and an external sending provider are separate matters.
Stripe access is configured for payments and subscriptions. Stripe handles payment information; Procora stores subscription, invoice and payment status rather than the card number. The processing role, recipients, retention and transfer terms depend on the relevant service and agreement.
Google — authorised customer data and optional measurements
PageSpeed, CrUX and Google OAuth have enabled configurations. PageSpeed/CrUX receive the public project URL for a measurement. Search Console requires separate customer read-only authorisation and a matching property. Encrypted tokens remain while connected; disconnecting removes local tokens. This does not prove a particular customer has connected or retrieved data.
Google Calendar reads busy intervals with the relevant access; it does not automatically write events. Google Analytics on the marketing website is separate, consent-controlled processing. These connections do not automatically establish sales, conversions or access to other Google products.
Optional channels, SMS and storage
Meta and Telegram channels require an actual connected channel, applicable provider terms and any necessary approvals. Account identifiers, display names and messages can be needed for replies on the selected channel. An integration option alone is not an activated channel.
Twilio credentials exist for the optional SMS path. This is not evidence of an approved account or working SMS delivery. Where used, information includes recipient number, message and delivery status. Direct telephone answering is not included.
Cloudflare R2 is a supported storage option in existing documentation. This directory does not verify a particular bucket’s activation, jurisdiction or backup expiry. Obtain the actual backup/storage configuration and agreement; do not infer encryption, EU location or instant erasure from a vendor name.
Optional analytics
Google Analytics, Meta Pixel and Microsoft Clarity can load on marketing pages after consent and relevant configuration. Private reports, audit input, login and customer workspaces are excluded. Resource events contain a resource identifier and action, not calculation values or test notes.
Change or withdraw the choice using Cookie settings in the footer. Necessary login/conversation functions are separate from these analytics tools. A website analytics script does not connect a customer’s Google Analytics to the audit tool.
Obtain agreements for your actual processing
Email support@procora.ai with the service, information types and any geographic restrictions, without sending customer records. Request the applicable DPA, recipient chain, processing/backup locations, access, retention criteria and transfer basis. Published vendor terms alone do not establish the agreement that applies to your account.
A new recipient or broader processing needs a separate assessment and appropriate instructions. This page is updated when the described configuration changes. It does not amend a signed agreement or automatically authorise sensitive information.
Sources and scope of review
First-party documentation reviewed 15 October 2026. Vendor statements are not independent product tests. Recheck your actual package and agreement.
Choose the next useful action
Compare the current scope before requesting setup. An educational guide does not activate a product or accept a paid engagement.