Sub-processors
Every vendor that touches your data.
The complete list of sub-processors, the data shared with each, and the region in which they operate. Updated as the stack changes.
01 · Change notice
Thirty days' notice on additions
When we add a new sub-processor we publish it on this page at least 30 days before it processes customer data. Subscribe to changes by emailing privacy@verticalai.com.au with the subject line “Sub-processor updates”.
Each sub-processor is bound by a data processing agreement that limits processing to instructed purposes and requires appropriate technical and organisational security measures.
02 · Current list
Sub-processors as of today
| Provider | Purpose | Data shared | Region |
|---|---|---|---|
| Supabase | Database and authentication | All application data (transcripts, accounts, billing references, configuration) | Sydney, AU |
| Fly.io | Voice agent compute | Audio streams in transit, transcripts in transit | Sydney, AU |
| Vercel | Web app hosting and CDN | App requests; no customer data at rest | Global edge |
| Stripe | Payment processing | Organisation name, billing email, payment tokens | United States (PCI Level 1) |
| Anthropic | LLM (default Claude Haiku, Sonnet, Opus) | Conversation context | United States |
| OpenAI | Optional LLM provider | Conversation context | United States |
| Google AI | Optional LLM and embeddings | Conversation context, knowledge-base embeddings | United States |
| Groq | Optional LLM (Llama 4 Scout) | Conversation context | United States |
| Deepgram | Speech-to-text | Audio stream | United States |
| Cartesia | Text-to-speech | Synthesis text | United States |
| Daily | WebRTC voice transport | Audio frames in real time | United States |
| Twilio | Inbound phone routing | Caller ID, call metadata | United States |
| Sentry | Error monitoring | Exception traces, scrubbed of PII | United States |
| Resend | Transactional email | Recipient email and invitation content | United States |
03 · Cross-border transfers
How we handle US-region vendors
Customer data at rest stays in Sydney. The vendors above with a United States region process limited data in transit during a session (synthesis text, audio stream, conversation context).
Cross-border transfers rely on the standard contractual clauses or equivalent safeguards published by each vendor. Where a sub-processor offers regional pinning that fits our latency budget, we use it (Fly.io and Supabase are pinned to Sydney for that reason).
Need a DPA covering this list?
Our standard DPA names each sub-processor and the data shared with it. Email the legal team for the latest version.