xAI (Grok API)
- Purpose
- Real-time voice agent + post-call analysis
- Data categories
- Live call audio, transcripts, voice tool inputs
- Location
- US
- DPA / BAA
- DPA via terms of service
Sub-processors
Last updated: May 27, 2026
Voxilo uses the following third-party service providers ("sub-processors") to operate the platform. Each is engaged under a written agreement that requires them to protect your data and process it only on Voxilo's instructions.
Current sub-processors
LiveKit Cloud
- Purpose
- Voice infrastructure (SIP, agent hosting, egress)
- Data categories
- Voice call audio, transcripts, recording artifacts
- Location
- US
- DPA / BAA
- DPA in place
Twilio
- Purpose
- Telephony + A2P SMS delivery
- Data categories
- Phone numbers, SMS content, call routing metadata
- Location
- US
- DPA / BAA
- DPA + BAA available
Anthropic (Claude)
- Purpose
- Fallback AI processing (gated)
- Data categories
- Call transcripts and summaries (when active)
- Location
- US
- DPA / BAA
- DPA via terms of service
Stripe
- Purpose
- Payment processing
- Data categories
- Subscriber billing information
- Location
- US
- DPA / BAA
- DPA in place
Supabase
- Purpose
- Database, auth, storage
- Data categories
- All platform data, including consent events
- Location
- US (AWS us-east-1)
- DPA / BAA
- DPA + BAA available
Vercel
- Purpose
- Website + app hosting
- Data categories
- Website analytics, session tokens
- Location
- Global edge
- DPA / BAA
- DPA in place
Railway
- Purpose
- Application hosting (API, voice worker, scheduler)
- Data categories
- Application data in transit
- Location
- US
- DPA / BAA
- DPA via terms of service
Mailgun
- Purpose
- Transactional email delivery
- Data categories
- Subscriber and recipient email addresses
- Location
- US
- DPA / BAA
- DPA + BAA available
Sentry
- Purpose
- Error tracking and monitoring
- Data categories
- Error context (de-identified where possible)
- Location
- US
- DPA / BAA
- DPA in place
PostHog
- Purpose
- Product analytics, feature flags
- Data categories
- Anonymous product usage events (no PII)
- Location
- EU / US
- DPA / BAA
- DPA in place
| Provider | Purpose | Data categories | Location | DPA / BAA |
|---|---|---|---|---|
| xAI (Grok API) | Real-time voice agent + post-call analysis | Live call audio, transcripts, voice tool inputs | US | DPA via terms of service |
| LiveKit Cloud | Voice infrastructure (SIP, agent hosting, egress) | Voice call audio, transcripts, recording artifacts | US | DPA in place |
| Twilio | Telephony + A2P SMS delivery | Phone numbers, SMS content, call routing metadata | US | DPA + BAA available |
| Anthropic (Claude) | Fallback AI processing (gated) | Call transcripts and summaries (when active) | US | DPA via terms of service |
| Stripe | Payment processing | Subscriber billing information | US | DPA in place |
| Supabase | Database, auth, storage | All platform data, including consent events | US (AWS us-east-1) | DPA + BAA available |
| Vercel | Website + app hosting | Website analytics, session tokens | Global edge | DPA in place |
| Railway | Application hosting (API, voice worker, scheduler) | Application data in transit | US | DPA via terms of service |
| Mailgun | Transactional email delivery | Subscriber and recipient email addresses | US | DPA + BAA available |
| Sentry | Error tracking and monitoring | Error context (de-identified where possible) | US | DPA in place |
| PostHog | Product analytics, feature flags | Anonymous product usage events (no PII) | EU / US | DPA in place |
Change notification
We will update this list and provide at least 30 days' advance notice to affected Subscribers before adding a new sub-processor that processes personal information. Notices are sent to the primary Subscriber email on file and posted at this URL.
Subscribers who have executed our Data Processing Addendum (DPA) may object to a new sub-processor within 14 days of the notice.
Questions
To request a list of our current BAA-covered sub-processors or to raise a concern, contact privacy@voxilo.ai.