Legal
Sub-processors
The third parties that may process customer data on our behalf, along with what they do, where they sit, and how transfers are safeguarded.
Last updated: May 26, 2026
1. What this page is
A sub-processor is a third-party service that VocUI engages to help deliver the platform and that may process customer personal data as part of that delivery. This page is the canonical list. It supplements (and is referenced by) our Privacy Policy and Terms of Service.
Sub-processors listed below are engaged under written agreements that require them to protect customer data, limit its use to the services they provide to us, and apply the transfer safeguards noted in each entry. Customer-side integrations that you connect yourself (e.g., your own Slack workspace, your own CalDAV calendar, your own Twilio account) are not VocUI sub-processors.
2. Current sub-processors
DeepSeek
- Service
- Large language model — default chat generation
- Data processed
- Customer chat input and the retrieved knowledge-base context sent to the model at request time
- Location
- People’s Republic of China
- Transfer safeguards
- Governed by DeepSeek’s published API terms. EU/UK customers who require alternative LLM routing can request Anthropic or OpenAI as their primary sub-processor on Enterprise plans.
Anthropic (Claude)
- Service
- Large language model — available on request
- Data processed
- Customer chat input and the retrieved knowledge-base context sent to the model at request time
- Location
- United States
- Transfer safeguards
- EU/UK transfers under Standard Contractual Clauses per Anthropic’s Data Processing Addendum.
OpenAI
- Service
- Embeddings (all plans) and optional chat fallback
- Data processed
- Knowledge-source text submitted for vectorization; chat input when OpenAI is the selected chat provider
- Location
- United States
- Transfer safeguards
- EU/UK transfers under Standard Contractual Clauses per OpenAI’s Data Processing Addendum.
Stripe
- Service
- Payment processing for subscriptions and add-ons
- Data processed
- Billing identifiers, payment method tokens, transaction metadata
- Location
- United States
- Transfer safeguards
- EU/UK transfers under Standard Contractual Clauses. Stripe acts as an independent controller for payment data.
OVH
- Service
- Infrastructure — Postgres database, application servers, object storage
- Data processed
- All application data at rest, including accounts, chatbots, knowledge bases, chat sessions, and billing records
- Location
- France (EU)
- Transfer safeguards
- Provider is EU-based. No additional cross-border transfer mechanism is required for EU/UK customer data stored on EU regions.
Telnyx
- Service
- Managed SMS, RCS, and voice (only for customers who enable these channels)
- Data processed
- Phone numbers, SMS contents, call audio, call metadata
- Location
- United States
- Transfer safeguards
- EU/UK transfers under Standard Contractual Clauses per Telnyx’s Data Processing Addendum.
- Notes
- Customers can bring their own Twilio account instead of using our managed Telnyx relationship; in that case Twilio becomes the customer’s direct sub-processor, not ours.
3. Notice on cross-border AI processing
DeepSeek, our default LLM sub-processor, is incorporated in the People’s Republic of China. Transfers of personal data to DeepSeek are governed by DeepSeek’s published API terms.
EU/UK customers who require an alternative LLM routing path — for example, to keep chat traffic within US-based providers under Standard Contractual Clauses — can request Anthropic (Claude) or OpenAI as the primary chat sub-processor on Enterprise plans. Contact [email protected] to arrange this routing before chat traffic is sent.
4. How we communicate changes
Material changes to this list — adding a new sub-processor, retiring one, or changing the jurisdiction in which a sub-processor processes customer data — will be communicated to customers at least 30 days before they take effect, by email to the account billing contact and by updating this page.
To subscribe to sub-processor change notifications without being a paying customer, email [email protected].
5. Contact
Questions about a specific sub-processor, transfer safeguards, or data-subject requests:
Email: [email protected]