Sub-Processors List
LiveThis page lists the third-party service providers ("Sub-Processors") that the Operator engages to process Customer Personal Data on Customer's behalf in connection with the Service, in accordance with Article 28(2) GDPR and Section 6 of the Data Processing Addendum. Customers are notified of any change at least 30 days before it takes effect (Section 6.3 of the DPA).
Subscribe to changes
Get notified of changes
Subscribe to receive an e-mail whenever this list changes (typically before the 30-day prior-notice period required by the DPA).
E-mail [email protected] with subject line [SUBSCRIBE Sub-Processors] to be added to the change-notification list.
Active sub-processors
Categorised by function. The Operator engages each Sub-Processor under a written data-processing agreement that imposes data-protection obligations no less protective than those in the DPA, including obligations as to security, confidentiality, sub-processing, return / deletion, audit, and assistance with Data Subject rights.
| Function | Sub-Processor | What we send | Region | Safeguards |
|---|---|---|---|---|
| Voice AI engine | ||||
| Voice AI orchestrator | Disclosed at category level only | Conversation orchestration: speech-to-text, intent routing, LLM coordination, text-to-speech | EU (zero-retention) | Signed DPA · zero-retention addendum · SCC Module 3 |
| LLM provider | OpenAI, OpenAI Ireland Ltd | Per-Call inference requests for selected GPT models | EU / US (zero-retention mode) | Signed DPA · SCC Module 3 · zero-retention addendum |
| LLM provider | Anthropic PBC | Per-Call inference requests for selected Claude models | US (zero-retention mode) | Signed DPA · SCC Module 3 · zero-retention addendum |
| LLM provider | Google LLC / Google Ireland Ltd | Per-Call inference requests for selected Gemini models | EU / US (zero-retention mode) | Signed DPA · SCC Module 3 · zero-retention addendum |
| TTS provider | ElevenLabs Inc. | Text-to-speech rendering of agent utterances | EU / US | Signed DPA · SCC Module 3 |
| TTS provider | Cartesia Inc. | Text-to-speech rendering of agent utterances | US | Signed DPA · SCC Module 3 |
| TTS provider | OpenAI voices (via OpenAI) | Text-to-speech rendering of agent utterances | EU / US (zero-retention) | See OpenAI row above |
| Telephony | ||||
| Telephony — primary | Twilio Inc. / Twilio Ireland Ltd | Outbound SIP trunking, PSTN delivery, inbound number provisioning, SMS where applicable | EU (Ireland) / US | Signed DPA · SCC Module 3 |
| Telephony — backup | Telnyx LLC | Backup SIP routing in failover scenarios | EU (Netherlands) / US | Signed DPA · SCC Module 3 |
| Telephony — selected markets | Vonage Holdings Corp. | Number provisioning and routing in selected markets | EU / US | Signed DPA · SCC Module 3 |
| Cloud infrastructure & data | ||||
| Hosting | Google Cloud Platform (Google Ireland Ltd / Google LLC) | Application compute, database storage, panel hosting, audit logs, encrypted backups, KMS | EU (Frankfurt eu-central-1, Warsaw europe-central2) | Signed DPA · SCC Module 3 · ISO 27001, SOC 2 Type II (provider) |
| Error monitoring | Sentry GmbH (subject to confirmation) | Application-error logs (PII redacted at SDK level) | EU (Germany) | Signed DPA · SCC Module 3 |
| Product analytics | PostHog Inc. or Plausible Insights OU (subject to selection) | Anonymised panel-usage analytics (consent-gated for marketing site) | EU | Signed DPA · SCC Module 3 |
| Billing & payments | ||||
| Payment processor & merchant of record | Stripe Payments Europe Ltd / Stripe Inc. | Subscription billing, payment-method storage (tokenised — Operator never sees full PAN), invoice generation, tax collection where applicable | EU (Ireland) / US | Signed DPA · SCC Module 3 · PCI DSS Level 1 (provider) · acts as independent controller for payment-card data |
| Communication & transactional messaging | ||||
| Transactional e-mail | Postmark (ActiveCampaign LLC) or Resend Inc. (subject to selection) | Operational e-mails — receipts, password resets, weekly reports, sub-processor change notices | EU / US | Signed DPA · SCC Module 3 |
| Storefront integration (controller, not Sub-Processor) | ||||
| Storefront / OAuth source | Shopify International Ltd / Shopify Inc. | OAuth handshake, order-event webhooks, catalog sync — Customer's relationship with Shopify is independent; Shopify is Customer's data controller for store data, not the Operator's Sub-Processor | Customer-determined (Shopify region) | Out of scope of this list — see Customer's contract with Shopify |
Per Section 4.1 of the DPA, voice audio is processed for communication purposes only and is not used to uniquely identify a natural person. Per Section 6.6 of the DPA, the LLM, TTS, and orchestrator providers operate under contractual zero-retention restrictions and do not use Customer Personal Data to train, fine-tune, or evaluate any AI model.
The voice-AI orchestrator is disclosed at category level only (Voice AI orchestrator). The Operator does not publicly name the underlying provider for security and contractual reasons.
Recent changes
| Date | Change | Effective from |
|---|---|---|
| 2026-01-01 | Initial publication of Sub-Processors List. | January 1, 2026 |
Adding, removing, or replacing a Sub-Processor
The Operator may add, remove, or replace a Sub-Processor. The procedure (Section 6 of the DPA):
- Notice — at least 30 days' prior notice by updating this list, e-mailing the primary contact on file, and (where the Customer has subscribed) e-mailing the change-notification list.
- Right to object — Customer may object on documented data-protection grounds within 30 days. The parties will discuss in good faith.
- Resolution — if the parties cannot resolve the objection within a further 30 days, Customer may, as its sole and exclusive remedy, terminate the affected portion of the Service for material breach and receive a pro-rata refund of any pre-paid fees for the unused period.
- Continuity — until removal takes effect, the Sub-Processor remains bound by the DPA's protection terms.
Audit and information rights
The Operator publishes on its public legal pages, or otherwise makes available to Customers within the panel, the following information:
- the substance of the zero-retention undertakings governing the orchestrator and LLM/TTS providers;
- the most recent third-party security report obtained from each Sub-Processor (where available, e.g., SOC 2 Type II for cloud infrastructure);
- the Operator's Transfer Impact Assessment summary;
- any other information reasonably necessary to demonstrate Article 28 GDPR compliance.
Audit rights are described in DPA Section 8.
Contact
- Sub-processor questions and subscription to changes: [email protected]
- Legal questions: [email protected]
- EU contact: [email protected] (designated EU representative — see Legal Notice)
- Operator phone: +1 (719) 624-4435
- Operator postal address: CallBotAgent, Inc., 1111B S Governors Ave STE 39750, Dover, DE 19904, USA