Sub-processors
Where your data is processed.
Providers that support the platform, website, billing, analytics, and sales, including what they may receive and where they operate.
Change notice
Updates to this list
We update this page when providers or processing arrangements materially change. A customer contract or DPA may require additional notice or an objection process. Ask about updates by emailing privacy@verticalai.com.au with the subject line “Sub-processor updates”.
We assess providers based on the service, data, location, and risk. Contractual and technical safeguards vary by provider and customer agreement.
Current list
Sub-processors as of today
| Provider | Purpose | Data shared | Region |
|---|---|---|---|
| Supabase | Database, authentication, storage | All application data (transcripts, accounts, billing references, configuration) | Sydney, AU |
| Fly.io | Voice agent compute | Audio and transcripts in transit | Sydney, AU |
| AWS Bedrock | AI inference (Claude) | Conversation context and service metadata | Sydney, AU (ap-southeast-2) |
| Daily | WebRTC voice transport | Audio frames in real time | Asia Pacific (media), United States (API) |
| Vercel | Web app hosting and CDN | Web requests, device data, and application responses | Sydney, AU (functions), global edge (static assets) |
| Optional model providers (OpenAI, Google, Groq, Cerebras, Inception) | Alternative LLMs, used only when an operator selects a non-default model | Conversation context | United States |
| Deepgram | Speech-to-text | Audio stream and speech metadata | Australia |
| ElevenLabs | Text-to-speech (default voice provider) | Text for synthesis and service metadata | United States |
| Cartesia | Text-to-speech | Text for synthesis and service metadata | United States |
| Telnyx | Inbound and outbound phone routing | Caller ID, call audio and metadata in transit | United States |
| Stripe | Payment processing | Organisation name, billing email, payment tokens | United States (PCI Level 1) |
| Resend | Transactional email | Recipient email and invitation content | United States |
| Sentry | Error monitoring | Exception traces and technical diagnostics | European Union |
| Axiom | Runtime traces, logs and metrics | Call and request telemetry: identifiers, timings, model names, and error traces | United States |
| Langfuse | Language-model tracing | Model call metadata; prompt and completion content only when a workspace raises its telemetry content level above the default | European Union |
| PostHog | Website and product analytics | Account-user and direct sales lead contact details, stable identifiers, workspace, device, page, feature, campaign, and event data; no customer prompts, transcripts, call audio, secrets, or sensitive call content | European Union |
| Meta | Advertising, campaign measurement, and lead management | Website, cookie, campaign, lead, and form interaction data | United States and global |
| Cal.com | Sales meeting scheduling | Name, work contact details, meeting details, and form responses | United States |
| Zapier | Sales and customer-configured automation | Contact, form, and workflow data used in configured automations | United States |
| Composio | App-connector OAuth and tool execution (only for apps a workspace connects) | OAuth tokens for connected apps; tool-call arguments and results (may include caller-provided data) | United States |
Cross-border transfers
How we handle overseas vendors
Core application data may be hosted in Sydney, and the default AI service may run there. Other providers process data in the United States, European Union, and global infrastructure. Processing can include storage, support access, analytics, or data in transit, depending on the service.
We use available contractual, organisational, regional, and technical safeguards. Customer contracts and DPAs may impose tighter residency, transfer, or provider terms.
Need a DPA covering this list?
Ask the legal team about processor, transfer, and customer-specific terms.