Subprocessor List

Last updated: October 24, 2026

Notification Policy

We will notify all registered users by email at least 30 days before engaging any new subprocessor. You may object to a new subprocessor per our Privacy Policy and Data Processing Addendum.

To subscribe to subprocessor change notifications, email legal@zoeyos.com with subject "Subscribe to Subprocessor Notifications."

Current Subprocessors

SubprocessorPurposeLocationData ProcessedTraining Commitment
Anthropic, PBCAI model inference (Claude)United StatesConversation inputs and outputsDoes NOT train on commercial customer data per their commercial API commitment
OpenAI, L.L.C.Embeddings for semantic search & memoryUnited StatesText content for embedding (conversations, knowledge)Does NOT train on API data per their commercial API terms
Cohere Inc.Reranking for memory & search retrievalUnited States / CanadaSearch queries and candidate text snippetsNot retained or used for training per their API terms
Theai, Inc. (dba Inworld)Speech-to-text transcription and text-to-speech voice synthesisUnited StatesAudio data and text content (processed in real-time)Zero Data Retention mode: audio/text inputs & outputs not persistently stored after processing; not used for training (SOC 2 Type 2, GDPR)
Stripe, Inc.Payment processingUnited StatesBilling information (name, email, payment method)PCI-DSS Level 1 certified; data used for payment processing only
Cloudflare, Inc.DDoS protection, WAF, CDN, DNSGlobal (300+ data centers)Network traffic metadataNo user content accessed; network-layer only
DigitalOcean, LLCCloud infrastructure and managed databaseUnited StatesAll application data (encrypted at rest and in transit)Infrastructure provider; no content access beyond hosting
Resend, Inc.Transactional and marketing email deliveryUnited StatesEmail addresses, email contentUsed for delivery only; does not retain content beyond delivery
Functional Software, Inc. (Sentry)Error monitoring and crash reportingUnited StatesError data, session metadataNo user content; error context only
Better Stack, Inc.Uptime monitoring and status pageUnited StatesEndpoint availability dataNo user content; availability checks only
PostHog, Inc.Website analytics; usage analytics in the desktop application (only for accounts where usage analytics is switched on)United States (PostHog US Cloud)Website: usage events, device/metadata (consent-gated). Desktop application: a random internal account identifier, plan, signup date, country, operating system, app version, and feature-usage and account events. No conversation content, files, names, or email addresses.Analytics only; not sold or used for advertising; not used for AI training (DPA signed; organization-level AI-training opt-out enabled)
Composio TechnologiesThird-party API integration and OAuth managementUnited StatesIntegration credentials, API call parametersUsed for integration execution only
LiveKit, Inc.Real-time voice streaming infrastructureUnited StatesAudio stream dataNo content retention; real-time relay only
Twilio, Inc.SMS and voice communicationsUnited StatesPhone numbers, message contentUsed for delivery only

Subprocessor Change History

DateChangeSubprocessorType
June 1, 2026Initial list publishedAll aboveAddition
June 23, 2026Replaced Cartesia with Theai, Inc. (dba Inworld) (text-to-speech)Cartesia / Theai, Inc. (dba Inworld)Replacement
June 23, 2026Added reranking provider for memory & search retrievalCohere Inc.Addition
June 23, 2026Added embeddings + analytics providers to the listOpenAI, L.L.C. / PostHog, Inc.Addition
October 6, 2026Extended analytics provider to optional usage analytics in the desktop applicationPostHog, Inc.Scope change
October 6, 2026Removed speech-to-text provider; speech-to-text now provided by Theai, Inc. (dba Inworld), already listedDeepgram, Inc.Removal

Questions

For questions about our subprocessors or data processing practices:

This page is updated whenever subprocessors change. Users are notified 30 days in advance of any addition.