xAI (Grok API)
- Purpose
- Real-time voice agent + post-call analysis
- Data categories
- Live call audio, transcripts, voice tool inputs
- Location
- US
- DPA / BAA
- Governing DPA artifact filed
Sub-processors
Last updated: June 26, 2026
Voxilo uses the following third-party service providers ("sub-processors") to operate the platform. Each is engaged under a written agreement that requires them to protect your data and process it only on Voxilo's instructions.
Current sub-processors
LiveKit Cloud
- Purpose
- Voice infrastructure (SIP, agent hosting, egress)
- Data categories
- Voice call audio, transcripts, recording artifacts
- Location
- US
- DPA / BAA
- Governing DPA artifact filed
Twilio
- Purpose
- Telephony + A2P SMS delivery
- Data categories
- Phone numbers, SMS content, call routing metadata
- Location
- US
- DPA / BAA
- DPA + BAA available
Anthropic (Claude)
- Purpose
- Fallback AI processing (gated)
- Data categories
- Call transcripts and summaries (when active)
- Location
- US
- DPA / BAA
- Governing DPA artifact filed
Stripe
- Purpose
- Payment processing
- Data categories
- Subscriber billing information
- Location
- US
- DPA / BAA
- DPA in place
Supabase
- Purpose
- Database, auth, storage
- Data categories
- All platform data, including consent events
- Location
- US (AWS us-west-2)
- DPA / BAA
- DPA + BAA available
Vercel
- Purpose
- Website + app hosting
- Data categories
- Website analytics, session tokens
- Location
- Global edge
- DPA / BAA
- DPA in place
Railway
- Purpose
- Application hosting (API, voice worker, scheduler)
- Data categories
- Application data in transit
- Location
- US
- DPA / BAA
- Governing DPA artifact filed
Mailgun
- Purpose
- Transactional email delivery
- Data categories
- Subscriber and recipient email addresses
- Location
- US
- DPA / BAA
- DPA + BAA available
Sentry
- Purpose
- Error tracking and monitoring
- Data categories
- Error context (de-identified where possible)
- Location
- US
- DPA / BAA
- DPA in place
PostHog
- Purpose
- Product analytics, feature flags
- Data categories
- Anonymous or pseudonymous product usage events
- Location
- US project / EU-US service footprint
- DPA / BAA
- DPA in place
| Provider | Purpose | Data categories | Location | DPA / BAA |
|---|---|---|---|---|
| xAI (Grok API) | Real-time voice agent + post-call analysis | Live call audio, transcripts, voice tool inputs | US | Governing DPA artifact filed |
| LiveKit Cloud | Voice infrastructure (SIP, agent hosting, egress) | Voice call audio, transcripts, recording artifacts | US | Governing DPA artifact filed |
| Twilio | Telephony + A2P SMS delivery | Phone numbers, SMS content, call routing metadata | US | DPA + BAA available |
| Anthropic (Claude) | Fallback AI processing (gated) | Call transcripts and summaries (when active) | US | Governing DPA artifact filed |
| Stripe | Payment processing | Subscriber billing information | US | DPA in place |
| Supabase | Database, auth, storage | All platform data, including consent events | US (AWS us-west-2) | DPA + BAA available |
| Vercel | Website + app hosting | Website analytics, session tokens | Global edge | DPA in place |
| Railway | Application hosting (API, voice worker, scheduler) | Application data in transit | US | Governing DPA artifact filed |
| Mailgun | Transactional email delivery | Subscriber and recipient email addresses | US | DPA + BAA available |
| Sentry | Error tracking and monitoring | Error context (de-identified where possible) | US | DPA in place |
| PostHog | Product analytics, feature flags | Anonymous or pseudonymous product usage events | US project / EU-US service footprint | DPA in place |
Optional customer-enabled integrations
The providers below are not mandatory platform sub-processors for every Voxilo customer. They become relevant only when a Subscriber connects its own account and asks Voxilo to write data into that destination.
Microsoft Outlook Calendar
- Purpose
- Subscriber-selected calendar booking destination
- Data categories
- Booking details, customer name, contact details, appointment metadata
- Location
- Customer-selected Microsoft tenant
- Contract posture
- Customer-directed integration
Google Calendar
- Purpose
- Subscriber-selected calendar booking destination
- Data categories
- Booking details, customer name, contact details, appointment metadata
- Location
- Customer-selected Google account
- Contract posture
- Customer-directed integration
Cal.com
- Purpose
- Subscriber-selected scheduling destination
- Data categories
- Booking details, customer name, contact details, appointment metadata
- Location
- Customer-selected Cal.com account
- Contract posture
- Customer-directed integration
HubSpot
- Purpose
- Subscriber-selected CRM sync destination
- Data categories
- Lead, contact, and CRM metadata chosen by the Subscriber
- Location
- Customer-selected HubSpot portal
- Contract posture
- Customer-directed integration
GoHighLevel
- Purpose
- Subscriber-selected CRM sync destination
- Data categories
- Lead, contact, and scheduling metadata chosen by the Subscriber
- Location
- Customer-selected GoHighLevel account
- Contract posture
- Customer-directed integration
Jobber
- Purpose
- Subscriber-selected field-service destination
- Data categories
- Lead, customer, and job-request details chosen by the Subscriber
- Location
- Customer-selected Jobber account
- Contract posture
- Customer-directed integration
Generic Webhook / Automation Destination
- Purpose
- Subscriber-selected automation destination
- Data categories
- Mapped workflow payloads chosen by the Subscriber
- Location
- Customer-selected webhook or automation workspace
- Contract posture
- Customer-directed integration
| Provider | Purpose | Data categories | Location | Contract posture |
|---|---|---|---|---|
| Microsoft Outlook Calendar | Subscriber-selected calendar booking destination | Booking details, customer name, contact details, appointment metadata | Customer-selected Microsoft tenant | Customer-directed integration |
| Google Calendar | Subscriber-selected calendar booking destination | Booking details, customer name, contact details, appointment metadata | Customer-selected Google account | Customer-directed integration |
| Cal.com | Subscriber-selected scheduling destination | Booking details, customer name, contact details, appointment metadata | Customer-selected Cal.com account | Customer-directed integration |
| HubSpot | Subscriber-selected CRM sync destination | Lead, contact, and CRM metadata chosen by the Subscriber | Customer-selected HubSpot portal | Customer-directed integration |
| GoHighLevel | Subscriber-selected CRM sync destination | Lead, contact, and scheduling metadata chosen by the Subscriber | Customer-selected GoHighLevel account | Customer-directed integration |
| Jobber | Subscriber-selected field-service destination | Lead, customer, and job-request details chosen by the Subscriber | Customer-selected Jobber account | Customer-directed integration |
| Generic Webhook / Automation Destination | Subscriber-selected automation destination | Mapped workflow payloads chosen by the Subscriber | Customer-selected webhook or automation workspace | Customer-directed integration |
Change notification
We will update this list and provide at least 30 days' advance notice to affected Subscribers before adding a new sub-processor that processes personal information. Notices are sent to the primary Subscriber email on file and posted at this URL.
Subscribers who have executed our Data Processing Addendum (DPA) may object to a new sub-processor within 14 days of the notice.
Questions
To request a list of our current BAA-covered sub-processors or to raise a concern, contact privacy@voxilo.ai.