Subprocessors · Vocito.ai

Last updated: 11 November 2026

Change: Added xAI and Railway. Anthropic now also powers the assistant in the dashboard. Every entry was checked again against the provider’s own terms.

1. What this list covers

Vocito processes personal data on behalf of its customers. For parts of that work we use other companies, called subprocessors. This page names each of them, with what it does for Vocito, which personal data it receives, where it processes that data and which safeguard applies when data leaves the European Economic Area (EEA).

The safeguard is the transfer mechanism named in the company’s own data processing terms, or its certification under the EU-U.S. Data Privacy Framework, checked at the source on 11 November 2026.

2. Current subprocessors

Anthropic

Company: Anthropic Ireland, Limited (Ireland)
Purpose: Language model (Claude) for the assistant in the dashboard, for working out your setup and for text tasks such as summaries and drafts. Once that feature is released, it also reads the photos and documents you share with the assistant.
Personal data: Messages to the assistant, business details you enter, and the text of calls, emails and other messages it summarises or drafts.
Where the data is processed: United States for stored data; the model may run in any country where Anthropic has capacity.
Safeguard outside the EEA: EU standard contractual clauses (modules 2 and 3) in Anthropic’s data processing addendum.

OpenAI

Company: OpenAI Ireland Ltd. (Ireland)
Purpose: Language model for text tasks such as drafts, summaries and sorting messages; speech to text for call recordings; search index for your knowledge base.
Personal data: Text of messages, calls and documents; call audio for transcription; the content of your knowledge base.
Where the data is processed: Outside the EEA. Vocito does not use OpenAI’s EU data residency option.
Safeguard outside the EEA: EU standard contractual clauses for transfers by OpenAI Ireland outside the EEA, under OpenAI’s data processing addendum.

xAI

Company: SpaceX Super Intelligence LLC (United States), which offers the xAI API
Purpose: Language model (Grok) for text tasks in the background, such as drafts, summaries and sorting messages.
Personal data: Text of messages, calls and other content it summarises or drafts.
Where the data is processed: Not fixed: xAI may route requests between its regions. It has no EU endpoint.
Safeguard outside the EEA: EU standard contractual clauses (modules 2 and 3) in xAI’s data processing addendum.

Google

Company: Google LLC (United States); for paid use from the EEA, Google Cloud EMEA Limited (Ireland)
Purpose: Language model (Gemini) for some text tasks, and as a fallback when the other language models are unavailable.
Personal data: Text of messages and other content it processes.
Where the data is processed: Any country where Google or its subprocessors have facilities.
Safeguard outside the EEA: EU-U.S. Data Privacy Framework (Google LLC is certified); EU standard contractual clauses as a fallback.

ElevenLabs

Company: Eleven Labs Inc. (United States)
Purpose: Voice: the AI voice agents that answer and make calls, with speech recognition and speech synthesis.
Personal data: Call audio, transcripts, the caller’s phone number and the text that is spoken.
Where the data is processed: United States, ElevenLabs’ standard storage location. Vocito does not use its EU data residency option.
Safeguard outside the EEA: EU-U.S. Data Privacy Framework (certified), or EU standard contractual clauses under ElevenLabs’ data processing addendum.

Deepgram

Company: Deepgram, Inc. (United States)
Purpose: Speech to text during calls made from the dialer, for live coaching.
Personal data: Call audio of both sides of the call, and transcripts.
Where the data is processed: United States and other countries. Vocito uses Deepgram’s standard endpoint, not its EU endpoint.
Safeguard outside the EEA: Not yet confirmed. Deepgram does not publish a data processing addendum and is not certified under the EU-U.S. Data Privacy Framework.

Twilio

Company: Twilio Ireland Limited (Ireland)
Purpose: Telephony: phone numbers, call routing and SMS, and SMS verification at sign-up (Twilio Verify).
Personal data: Phone numbers, call metadata, call audio while the call is connected, and SMS content.
Where the data is processed: United States, Twilio’s default region (US1). Vocito does not use Twilio’s EU region.
Safeguard outside the EEA: In this order: EU-U.S. Data Privacy Framework (Twilio Inc. is certified), Twilio’s binding corporate rules, EU standard contractual clauses.

Supabase

Company: Supabase Pte. Ltd. (Singapore)
Purpose: Database, sign-in and file storage.
Personal data: All data stored in your Vocito workspace, such as contacts, bookings, messages, call transcripts and files.
Where the data is processed: Ireland (EU), region eu-west-1, where the data is stored. Supabase may also process it in other countries where it or its subprocessors have facilities.
Safeguard outside the EEA: EU standard contractual clauses (modules 2 and 3) in Supabase’s data processing addendum.

Railway

Company: Railway Corporation (United States)
Purpose: Hosting of the Vocito backend, the servers that run the application.
Personal data: All data that passes through the application while it is being processed.
Where the data is processed: The Netherlands (EU), region europe-west4 in Amsterdam, where the Vocito backend runs. Railway’s own operations are mainly in the United States.
Safeguard outside the EEA: EU-U.S. Data Privacy Framework (certified), or EU standard contractual clauses under Railway’s data processing addendum.

Vercel

Company: Vercel Inc. (United States)
Purpose: Hosting of the dashboard, the website and web forms.
Personal data: IP addresses and request logs of visitors.
Where the data is processed: United States, plus Vercel’s worldwide network that serves pages close to the visitor.
Safeguard outside the EEA: EU standard contractual clauses (modules 1, 2 and 3) in Vercel’s data processing addendum. Vercel Inc. is also certified under the EU-U.S. Data Privacy Framework.

Netlify

Company: Netlify, Inc. (United States)
Purpose: Hosting of the public booking pages (book.vocito.ai). Booking details go straight to the Vocito backend.
Personal data: IP addresses and request logs of visitors to the booking pages.
Where the data is processed: Outside the EEA, including the United States.
Safeguard outside the EEA: EU-U.S. Data Privacy Framework (certified); EU standard contractual clauses (modules 2 and 3) as a fallback, under Netlify’s data processing agreement.

Stripe

Company: Stripe Payments Europe, Limited (Ireland)
Purpose: Payments: subscriptions to Vocito, and payment links and paid bookings through your own connected Stripe account.
Personal data: Name, email address, billing details and payment details of the person who pays.
Where the data is processed: United States (Stripe, LLC) and other countries where Stripe operates.
Safeguard outside the EEA: EU-U.S. Data Privacy Framework (Stripe, LLC is certified); EU standard contractual clauses as a fallback.

Resend

Company: Plus Five Five, Inc., trading as Resend (United States)
Purpose: Email delivery, such as booking confirmations, reminders and notifications.
Personal data: Names and email addresses of recipients, and the content of the messages.
Where the data is processed: Emails are sent from Ireland (EU, region eu-west-1). Resend stores account data, email metadata and logs in the United States.
Safeguard outside the EEA: EU standard contractual clauses (modules 1, 2 and 3) in Resend’s data processing addendum. Resend is on the Data Privacy Framework list, with its recertification under review.

Sentry

Company: Functional Software, Inc., trading as Sentry (United States)
Purpose: Error monitoring of the backend and the dashboard.
Personal data: Technical error data, which can incidentally contain personal data.
Where the data is processed: Germany (EU), Sentry’s Frankfurt data region. Some account and project data is always kept in the United States.
Safeguard outside the EEA: EU-U.S. Data Privacy Framework (certified); EU standard contractual clauses (modules 2 and 3) as a fallback.

3. Services you connect yourself

Some features work with an account you hold at another service, such as Google, Microsoft, Meta (WhatsApp, Instagram, Facebook) or LinkedIn. That service processes the data under your own agreement with it. It is not a subprocessor of Vocito and is therefore not on this list.

4. Changes and your right to object

Before we add or replace a subprocessor, we inform customers by email at least 30 days in advance.

You can object within 14 days of receiving that notice. If we cannot resolve the objection together, you may end the affected service without a penalty.

Send an objection to: privacy@vocito.ai

Full terms: Data Processing Agreement (DPA)

5. Notices by email

Customers receive these notices at the email address of their account. To receive them at another address, send an email with the subject “Subprocessor updates” to: privacy@vocito.ai

6. Change log

Date	Change
11 November 2026	Added xAI and Railway. Anthropic now also powers the assistant in the dashboard. Every entry was checked again against the provider’s own terms.
6 September 2026	Added Anthropic, Deepgram, Resend, Vercel and Sentry.
11 April 2026	Added Twilio Verify (SMS verification at sign-up).
9 April 2026	First list published.

7. Contact

Company: HSR Agency, trading as Vocito.ai
Legal form: Sole proprietorship (eenmanszaak), registered in the Netherlands
Chamber of Commerce (KvK): 95570446
Registered in: The Hague, the Netherlands
Privacy: privacy@vocito.ai