| Vapi | Voice agent infrastructure — places and receives AI voice calls, generates call recordings and transcripts. | Phone numbers; Call audio / recordings; Call transcripts; Contact names | United States, European Union | DPA / legal | 🟢 Active |
| Telnyx | Telephony and SMS infrastructure — phone-number provisioning, voice trunking, and SMS/MMS messaging. | Phone numbers; Call metadata; SMS/MMS message content | United States, European Union | DPA / legal | 🟢 Active |
| Twilio | Telephony/SMS delivery and multi-factor authentication (Twilio Verify). The MFA identity sent to Twilio is an opaque user identifier only. | Phone numbers; SMS message content; Opaque user identifiers (MFA) | United States, European Union | DPA / legal | 🟢 Active |
| OpenAI | Large-language-model inference and text embeddings — chat/RAG replies, call summaries, classification, and knowledge enrichment. EU-account inference is pinned to OpenAI’s EU data-residency endpoint under a zero-retention / no-training agreement. | Conversation and message content; Call transcripts; Contact details contained in prompts | United States, European Union | DPA / legal | 🟢 Active |
| Pinecone | Vector storage for knowledge-base retrieval (RAG) — stores embeddings derived from uploaded knowledge-base documents. | Knowledge-base document content; Derived embeddings (may contain customer data) | United States, European Union | DPA / legal | 🟢 Active |
| Supabase | Primary application database, authentication, and file storage. EU customer data is held in a dedicated EU Supabase project. | Account and user data; Contact records; Conversation and message history; Uploaded files | United States, European Union | DPA / legal | 🟢 Active |
| Amazon Web Services (AWS) | Cloud infrastructure — application compute (ECS), container registry, and job-queue/cache (Redis). EU workloads run in eu-central-1. | All personal data processed in transit and during compute | United States (us-east), European Union (eu-central-1) | DPA / legal | 🟢 Active |
| Stripe | Payment processing and subscription billing. Stripe operates globally and stores EU customer billing data in the EU under its DPA; any incidental transfer is covered by Standard Contractual Clauses. | Name; Email address; Billing address; Payment-method / card details | Global (EU-resident for EU customers) | DPA / legal | 🟢 Active |
| BetterStack | Application logging, traces, and observability. Log payloads are PII-scrubbed before shipping; EU-account log lines are routed to an EU-region source. | Application log lines (pseudonymised identifiers, error context) | United States, European Union | DPA / legal | 🟢 Active |
| Mailgun (Sinch) | Transactional email delivery — magic links, notifications, AI email replies, and workflow Send-Email actions. EU-account email is sent through Mailgun’s EU region. | Recipient email address; Account context; End-user PII contained in email bodies | United States, European Union | DPA / legal | 🟢 Active |
| Sprinto | Compliance automation platform — tracks our security controls, sub-processor DPAs, and audit evidence. | Limited administrator and account metadata used for compliance evidence | United States | DPA / legal | 🟢 Active |
