Sub-processors
Where your data is processed.
Your stored data lives in Australia. Here is every vendor that processes data in transit, what they see, and where they operate. Updated as the stack changes.
01 · Change notice
Thirty days' notice on additions
When we add a new sub-processor we publish it on this page at least 30 days before it processes customer data. Subscribe to changes by emailing privacy@verticalai.com.au with the subject line “Sub-processor updates”.
Each sub-processor is bound by a data processing agreement that limits processing to instructed purposes and requires appropriate technical and organisational security measures.
02 · Current list
Sub-processors as of today
| Provider | Purpose | Data shared | Region |
|---|---|---|---|
| Supabase | Database, authentication, storage | All application data (transcripts, accounts, billing references, configuration) | Sydney, AU |
| Fly.io | Voice agent compute | Audio and transcripts in transit | Sydney, AU |
| AWS Bedrock | AI inference (Claude) | Conversation context; not stored or used for training | Sydney, AU (ap-southeast-2) |
| Daily | WebRTC voice transport | Audio frames in real time | Sydney, AU (media) |
| Vercel | Web app hosting and CDN | App requests; no customer data at rest | Global edge |
| Optional model providers (OpenAI, Google, Groq) | Alternative LLMs, used only when an operator selects a non-default model | Conversation context | United States |
| Deepgram | Speech-to-text | Audio stream in transit; not stored, training opt-out | United States |
| Cartesia | Text-to-speech | Synthesis text in transit; not stored, training opt-out | United States |
| Telnyx | Inbound phone routing | Caller ID, call audio and metadata in transit | United States |
| Stripe | Payment processing | Organisation name, billing email, payment tokens | United States (PCI Level 1) |
| Resend | Transactional email | Recipient email and invitation content | United States |
| Sentry | Error monitoring | Exception traces, scrubbed of PII | European Union |
| Composio | App-connector OAuth and tool execution (only for apps a workspace connects) | OAuth tokens for connected apps; tool-call arguments and results (may include caller-provided data) | United States |
03 · Cross-border transfers
How we handle overseas vendors
Customer data at rest stays in Sydney, and AI inference runs in Sydney on AWS Bedrock. The vendors above with an overseas region process limited data in transit during a session (speech-to-text, text-to-speech, error monitoring) and do not store it.
Cross-border transfers rely on the standard contractual clauses or equivalent safeguards published by each vendor. Where a sub-processor offers regional pinning that fits our latency budget, we use it: Supabase, Fly.io and AWS Bedrock are pinned to Sydney, and Daily media to the Australian region.
Need a DPA covering this list?
Our standard DPA names each sub-processor and the data shared with it. Email the legal team for the latest version.