Subprocessors

This page lists the subprocessors authorized under our Data Processing Addendum. Each subprocessor is bound by a written agreement imposing data protection obligations consistent with those we make to our customers. All listed subprocessors process data in the United States as part of normal service delivery.

Current Subprocessors

• Google Cloud Platform / FirebaseUnited States

  Production application hosting (Firebase App Hosting), database (Cloud Firestore), file storage, and authentication infrastructure.

  Google Cloud DPA

• VercelUnited States

  Build and preview deployment infrastructure used during development. Production traffic is served from Google Cloud / Firebase App Hosting.

  Vercel DPA

• StripeUnited States

  Payment processing, subscription billing, and invoicing.

  Stripe DPA

• TwilioUnited States

  Telephony carrier services: phone numbers and inbound/outbound calls. (Texting callers is not live yet.)

  Twilio DPA

• VapiUnited States

  Voice AI orchestration: connects telephony, speech-to-text, the language model, and text-to-speech for live calls.

  Vapi privacy & data terms

• OpenAIUnited States

  Large language model inference for conversation handling during live calls (through Vapi).

  OpenAI DPA

• AnthropicUnited States

  Large language model inference for guided conversation flows and response generation.

  Anthropic commercial terms & DPA

• DeepgramUnited States

  Speech-to-text transcription of live calls (through Vapi), and a fallback text-to-speech provider for dashboard voice previews.

  Deepgram DPA

• ElevenLabsUnited States

  Text-to-speech for dashboard voice previews (as a fallback provider), and for live calls when a business chooses an ElevenLabs voice in Settings.

  ElevenLabs DPA

• Microsoft Azure (AI Speech)United States

  Text-to-speech: the default voice on Spanish-language lines and the Azure voices a business can choose for live calls (through Vapi), a backup voice if a live call’s chosen voice fails, and dashboard voice previews. Speech-to-text: a backup transcriber if the main one fails on a live call (through Vapi). Government tenants use Azure voices only.

  Microsoft Products and Services DPA

• xAIUnited States

  Text-to-speech: the default English voice on live calls, and the phone demo line’s voice (through Vapi).

  xAI legal terms

• InworldUnited States

  Text-to-speech: a voice a business can choose for its live calls (through Vapi).

  Inworld privacy policy

• UpstashUnited States

  Redis-backed rate limiting for API and authentication endpoints.

  Upstash trust & DPA

• SentryUnited States

  Application error monitoring and performance diagnostics.

  Sentry DPA

• ResendUnited States

  Transactional email delivery (notifications, receipts, account messages).

  Resend DPA

Changes to This List

Before engaging a new subprocessor that will process customer personal data, we update this page and notify customers via email or dashboard notice. Customers may object to a new subprocessor within thirty (30) days of notice, as described in the Data Processing Addendum.

Not every vendor above touches every call: live calls run through Vapi with Deepgram transcription, an OpenAI model and, by default, an xAI voice in English or an Azure voice in Spanish. A business can choose an Inworld, ElevenLabs or Azure voice instead, and the demo line uses the xAI voice. Azure stands in if a live call’s transcriber fails, or its voice when that voice comes from another provider. ElevenLabs is also used for voice previews in the dashboard. Government tenants are pinned to Azure voices.

Questions

For questions about our subprocessors or to request notification of changes, contact us:

Related Documents