Subprocessor List
Last updated: June 23, 2026
Notification Policy
We will notify all registered users by email at least 30 days before engaging any new subprocessor. You may object to a new subprocessor per our Privacy Policy and Data Processing Addendum.
To subscribe to subprocessor change notifications, email legal@zoeyos.com with subject "Subscribe to Subprocessor Notifications."
Current Subprocessors
| Subprocessor | Purpose | Location | Data Processed | Training Commitment |
|---|---|---|---|---|
| Anthropic, PBC | AI model inference (Claude) | United States | Conversation inputs and outputs | Does NOT train on commercial customer data per their commercial API commitment |
| OpenAI, L.L.C. | Embeddings for semantic search & memory | United States | Text content for embedding (conversations, knowledge) | Does NOT train on API data per their commercial API terms |
| Cohere Inc. | Reranking for memory & search retrieval | United States / Canada | Search queries and candidate text snippets | Not retained or used for training per their API terms |
| Deepgram, Inc. | Speech-to-text transcription | United States | Audio data (processed in real-time) | Audio NOT retained after processing; not used for training |
| Theai, Inc. (dba Inworld) | Text-to-speech voice synthesis | United States | Text content for voice synthesis | Zero Data Retention mode: text inputs & audio outputs not persistently stored after processing; not used for training (SOC 2 Type 2, GDPR) |
| Stripe, Inc. | Payment processing | United States | Billing information (name, email, payment method) | PCI-DSS Level 1 certified; data used for payment processing only |
| Cloudflare, Inc. | DDoS protection, WAF, CDN, DNS | Global (300+ data centers) | Network traffic metadata | No user content accessed; network-layer only |
| DigitalOcean, LLC | Cloud infrastructure and managed database | United States | All application data (encrypted at rest and in transit) | Infrastructure provider; no content access beyond hosting |
| Resend, Inc. | Transactional and marketing email delivery | United States | Email addresses, email content | Used for delivery only; does not retain content beyond delivery |
| Functional Software, Inc. (Sentry) | Error monitoring and crash reporting | United States | Error data, session metadata | No user content; error context only |
| Better Stack, Inc. | Uptime monitoring and status page | United States | Endpoint availability data | No user content; availability checks only |
| PostHog, Inc. | Product & website analytics | United States | Website usage events, device/metadata (consent-gated) | Analytics only; not sold or used for advertising; not used for AI training |
| Composio Technologies | Third-party API integration and OAuth management | United States | Integration credentials, API call parameters | Used for integration execution only |
| LiveKit, Inc. | Real-time voice streaming infrastructure | United States | Audio stream data | No content retention; real-time relay only |
| Twilio, Inc. | SMS and voice communications | United States | Phone numbers, message content | Used for delivery only |
Subprocessor Change History
| Date | Change | Subprocessor | Type |
|---|---|---|---|
| June 1, 2026 | Initial list published | All above | Addition |
| June 23, 2026 | Replaced Cartesia with Theai, Inc. (dba Inworld) (text-to-speech) | Cartesia / Theai, Inc. (dba Inworld) | Replacement |
| June 23, 2026 | Added reranking provider for memory & search retrieval | Cohere Inc. | Addition |
| June 23, 2026 | Added embeddings + analytics providers to the list | OpenAI, L.L.C. / PostHog, Inc. | Addition |
Questions
For questions about our subprocessors or data processing practices:
- Email: legal@zoeyos.com
- See also: Privacy Policy | Data Processing Addendum