UK GDPR Article 28
Subprocessors
Stable URL: /subprocessors • Last reviewed: September 2026
Template notice: This list is maintained alongside the Privacy Policy and DPA template. It is pending solicitor review and must not be relied on for real contracts or payments.
Voxflow engages the following third parties to process personal data on behalf of our customers. We notify customers of any change to this list before it takes effect, per the DPA change-notice clause. Anything not listed here does not touch customer data.
Amazon Web Services (Connect + Lex + S3 + RDS + EC2)
- purpose:
- Telephony ingress, speech capture, call-recording storage, primary database, API hosting, secrets (KMS)
- data:
- Call audio recordings, contact-flow metadata, consent evidence, call records, tenant ledgers
- location:
- eu-west-2 (London)
Supabase
- purpose:
- Authentication identities; Postgres where configured
- data:
- Auth identities, call records and tenant ledgers (where enabled)
- location:
- EU region (confirm project region at solicitor review)
Groq
- purpose:
- Transient LLM inference and hosted Whisper speech-to-text
- data:
- Call content in flight — processed, not retained
- location:
- US (confirm against Groq DPA at solicitor review)
Stripe Payments UK Ltd
- purpose:
- Subscription billing and metered usage
- data:
- Billing identity, payment status, usage minutes
- location:
- UK / EU
Resend
- purpose:
- Transactional email (policy confirmations, invoices, alerts)
- data:
- Recipient email, message content, delivery metadata
- location:
- US
Sentry
- purpose:
- PII-scrubbed error monitoring (frontend + API)
- data:
- Scrubbed error events only — emails, phones, PINs redacted before send
- location:
- Confirm org region at solicitor review
PostHog (EU cloud)
- purpose:
- First-party product analytics, allow-listed non-identifying events only
- data:
- Pseudonymous events, no IP capture, localStorage state (no tracking cookies)
- location:
- EU (verify POSTHOG_HOST in production)
Crisp
- purpose:
- In-app support chat
- data:
- Chat transcripts, visitor email where provided
- location:
- EU
Vercel
- purpose:
- Frontend hosting for voxflow.cc (edge network)
- data:
- Account data in transit, TLS termination logs
- location:
- US / EU (global edge)
Cloudflare
- purpose:
- DNS, bot protection (Turnstile), email routing for voxflow.cc aliases
- data:
- DNS queries, Turnstile tokens, routed mail headers
- location:
- Global (security/DNS — limited personal data)
Microsoft (Edge TTS)
- purpose:
- Dashboard simulator voice synthesis only — never caller audio
- data:
- Operator-entered simulator text
- location:
- Cloud (simulator scope only)
Google Sheets (optional)
- purpose:
- Per-tenant call-log mirror only, never the source of truth
- data:
- Call outcome rows for tenants that enable mirroring
- location:
- Customer's Google account region
Questions: Privacy Policy • Full processor terms in the DPA template (available on request).