Subprocessors

Current subprocessors

Assay engages the following subprocessors to deliver the Service. Each is bound by a written contract scoped to a single purpose. Customer data is stored and processed in the United States (or under a no-retention US enterprise endpoint, where noted). Cloudflare routes requests through its global edge network on the way to US infrastructure.

• Retell AI, Inc. — voice orchestration, speech-to-text, and call handling. Audio is processed through Retell AI’s US-hosted infrastructure; held in memory only and never written to disk. Region: US-hosted.
• ElevenLabs, Inc. — speech synthesis (text-to-speech) for outbound voice. US inference. Region: US inference.
• Google LLC (Gemini 2.0 Flash) — language-model inference for transcript understanding and decision logic. Operated under a no-retention enterprise endpoint; no data sent for inference is logged, retained, or used for training. Region: US (no-retention enterprise endpoint).
• Supabase, Inc. — database for transcripts, scores, and account records. US region. Region: US region.
• Hetzner Online GmbH — compute and storage for the Assay application. US deployment. Region: US deployment.
• Twilio Inc. — telephone carrier services: phone numbers, call connectivity, and message delivery. Receives call metadata and carries call audio in transit. Region: US.
• Resend, Inc. — bulk email delivery, including follow-up and drip sequences. Receives recipient email addresses and message content. Region: US.
• n8n GmbH (legacy integrations) — legacy workflow automation for customer integrations. Receives only the lead and call-outcome fields an integration is configured to pass. Region: US-hosted workflows.
• Cloudflare, Inc. — DNS, TLS termination, content delivery, and DDoS protection for Assay sites and the application. Handles request traffic in transit. Region: Global edge network (request routing; customer data stored in the US).
• Cloudflare, Inc. (Workers) — edge compute that runs Assay code for integrations and webhooks. Handles the request payloads of the integrations it serves. Region: Global edge network (request routing; customer data stored in the US).
• Stripe, Inc. — payment processing. Receives only billing information; never receives call content or contact-list data. Region: US (billing only; no call data).

Changes and notice

We notify customers by email at least 30 days before adding a new subprocessor. Material changes to this list are also reflected on this page and on /security.

Questions about subprocessors: [email protected] or [email protected].