Subprocessors
Last updated: July 8, 2026
This page lists every third-party service that processes Tedigo Agency customer data, along with their role, region, and data-transfer mechanism for international transfers. Tedigo gives customers 30 days' notice (via email and a posted update here) before adding any new subprocessor.
For a signed Data Processing Addendum (DPA) covering this list, see our DPA. For privacy practices in plain language, see our Privacy Policy.
Infrastructure
Hetzner Online GmbH
- Role
- Primary cloud infrastructure (compute and private network). Documents, embeddings, and search indexes are stored on self-hosted systems running on this infrastructure — document content is not sent to any AI vendor for indexing.
- Region
- Ashburn, Virginia, USA. EU residency (Falkenstein, DE / Helsinki, FI) available on request.
- Data categories
- Account data, conversation logs, uploaded documents, embeddings, payment metadata, audit logs.
- Transfer mechanism
- EU-US Data Privacy Framework (Hetzner Cloud Inc., DPF-certified) + Standard Contractual Clauses in signed DPA.
Cloudflare, Inc. (R2)
- Role
- Off-site encrypted backup storage only — backups are encrypted (AES-256) before upload, so Cloudflare never receives plaintext. Not primary storage.
- Region
- United States / global.
- Data categories
- Encrypted backups of account data, conversation logs, and uploaded files.
- Transfer mechanism
- DPF-certified + SCCs in Cloudflare DPA.
AI Inference
Groq, Inc. — default AI provider
- Role
- The AI provider managed Agency plans actually run on: chat generation, speech-to-text (Whisper), and text-to-speech (Orpheus).
- Region
- United States (datacenters in TX, VA).
- Data categories
- User prompts, conversation context, voice audio, generated voice audio, transcripts. Groq does not train on customer data per ToS.
- Transfer mechanism
- SCCs (DPF certification status verified per request).
Google LLC (Gemini)
- Role
- Real-time voice with per-turn function calling.
- Region
- United States and global Google datacenters.
- Data categories
- Voice audio, transcripts, function-call results. Customer data is not used for training (paid API).
- Transfer mechanism
- DPF-certified + SCCs in Google Cloud DPA.
Fixie.ai, Inc. (Ultravox)
- Role
- Real-time voice agent infrastructure with server-tool retrieval.
- Region
- United States. Subprocessor chain: Ultravox → LiveKit (real-time transport).
- Data categories
- Voice audio, transcripts, server-tool payloads.
- Transfer mechanism
- SCCs.
Customer-Connected AI (BYOK) — governed by your own provider agreement
OpenAI, L.L.C.
- Role
- Chat generation only when you connect your own OpenAI API key (BYOK). Managed Agency plans run on Groq — Tedigo’s keys do not send your conversations to OpenAI, and no documents or embeddings go to OpenAI (retrieval is fully self-hosted).
- Region
- United States.
- Data categories
- User prompts and conversation context — only on conversations you route through your own key.
- Transfer mechanism
- Your own OpenAI agreement governs (BYOK). OpenAI is DPF-certified; API data is not used for training (paid API default).
Anthropic PBC
- Role
- Tedigo holds no Anthropic key, and Claude does not currently serve Agency conversations. Anthropic keys you store (for use with other Tedigo products) are held encrypted; any Claude traffic runs under your own Anthropic agreement.
- Region
- United States.
- Data categories
- None for Agency conversations today.
- Transfer mechanism
- Your own Anthropic agreement governs (BYOK).
Telephony Carrier
Telnyx LLC
- Role
- Telephony carrier for Tedigo-provisioned phone numbers: inbound and outbound voice (PSTN), SIP trunking to the voice AI, and E911 registration.
- Region
- United States; Telnyx global infrastructure.
- Data categories
- Caller and called numbers, call duration, timestamps, call audio in transit (and recordings when enabled), SMS content and metadata if SMS is used.
- Transfer mechanism
- SCCs in Telnyx DPA.
Twilio Inc. (legacy — winding down)
- Role
- Former telephony carrier. No new calls are routed through Twilio; historical call recordings made before the June 2026 Telnyx cutover may remain on the account until deletion/closure. This entry will be removed once the account is confirmed closed.
- Region
- United States; Twilio global edge.
- Data categories
- Historical call recordings and call metadata from before the cutover.
- Transfer mechanism
- DPF-certified + SCCs in Twilio DPA.
Payment Processing
Stripe, Inc.
- Role
- Payment processing, subscription billing, customer portal.
- Region
- United States and Stripe global infrastructure.
- Data categories
- Email, name, billing address, payment method (held by Stripe — Tedigo never sees card data). PCI-DSS Level 1.
- Transfer mechanism
- DPF-certified + SCCs in Stripe DPA.
DNS and Operational
Cloudflare, Inc.
- Role
- DNS for tedigo.com zone.
- Region
- United States + global anycast.
- Data categories
- DNS query logs (IP addresses, query patterns).
- Transfer mechanism
- DPF-certified + SCCs in Cloudflare DPA.
DigitalOcean, LLC
- Role
- DNS hosting for tedigo.com zone.
- Region
- United States + global.
- Data categories
- DNS query logs.
- Transfer mechanism
- DPF-certified + SCCs in DigitalOcean DPA.
Notification of changes
We update this page whenever we add, remove, or change a subprocessor. Existing customers receive an email notice at least 30 days before the change takes effect, in accordance with our DPA. If you object to a new subprocessor, you may terminate your subscription before the change takes effect with a prorated refund of any prepaid amount.
Questions
Email agency@tedigo.net for questions about subprocessors, data residency, or to request EU-region hosting.