UK GDPR Article 28
Subprocessors
Stable URL: /subprocessors • Last reviewed: September 2026
Standard UK SaaS terms notice: This list is maintained alongside our Privacy Policy and DPA template (standard UK SaaS terms, last reviewed September 2026, not bespoke legal advice).
Voxflow engages the following third parties to process personal data on behalf of our customers. We notify customers of any change to this list before it takes effect, per the DPA change-notice clause. Anything not listed here does not touch customer data.
Amazon Web Services EMEA SARL (Connect + Lex + S3 + RDS + EC2)
- purpose:
- Telephony ingress, speech capture, call-recording storage, primary relational database (RDS PostgreSQL), API hosting (EC2), secrets (KMS)
- data:
- Call audio recordings, contact-flow metadata, consent evidence, call records, tenant ledgers, application state
- location:
- eu-west-2 (London, UK); one legacy +44 number (+44 20 4640 4552: legacy, migration in progress) still routes via us-west-2 pending migration
Supabase Inc.
- purpose:
- User authentication, identity directory, and session token management
- data:
- User authentication identities (email addresses, encrypted auth credentials, user UUIDs)
- location:
- EU region
Groq
- purpose:
- Transient LLM inference and hosted Whisper speech-to-text
- data:
- Call content in flight — processed, not retained
- location:
- US (confirm against Groq DPA at solicitor review)
Stripe Payments UK Ltd
- purpose:
- Subscription billing and metered usage
- data:
- Billing identity, payment status, usage minutes
- location:
- UK / EU
Resend
- purpose:
- Transactional email (policy confirmations, invoices, alerts)
- data:
- Recipient email, message content, delivery metadata
- location:
- US
Sentry
- purpose:
- PII-scrubbed error monitoring (frontend + API)
- data:
- Scrubbed error events only — emails, phones, PINs redacted before send
- location:
- Confirm org region at solicitor review
PostHog (EU cloud)
- purpose:
- First-party product analytics, allow-listed non-identifying events only
- data:
- Pseudonymous events, no IP capture, localStorage state (no tracking cookies)
- location:
- EU (verify POSTHOG_HOST in production)
Crisp
- purpose:
- In-app support chat
- data:
- Chat transcripts, visitor email where provided
- location:
- EU
Vercel
- purpose:
- Frontend hosting for voxflow.cc (edge network)
- data:
- Account data in transit, TLS termination logs
- location:
- US / EU (global edge)
Cloudflare
- purpose:
- DNS, bot protection (Turnstile), email routing for voxflow.cc aliases
- data:
- DNS queries, Turnstile tokens, routed mail headers
- location:
- Global (security/DNS — limited personal data)
Microsoft (Edge TTS)
- purpose:
- Dashboard simulator voice synthesis only — never caller audio
- data:
- Operator-entered simulator text
- location:
- Cloud (simulator scope only)
Google Sheets (optional)
- purpose:
- Per-tenant call-log mirror only, never the source of truth
- data:
- Call outcome rows for tenants that enable mirroring
- location:
- Customer's Google account region
Questions: Privacy Policy • Full processor terms in the DPA template (available on request).