Security · Data protection
Sub-processors
Avatia engages a number of sub-processors (providers) to deliver the service, each of which may process personal data on the controller's behalf under data-protection obligations equivalent to those set out in the Agreement.
| Sub-processor | Service / purpose | Processing location & transfer safeguard |
|---|---|---|
| Amazon Web Services EMEA SARL | Cloud infrastructure: hosting, database, storage and primary AI-model inference (Bedrock) | European Union — eu-west-1 (model inference via Bedrock in eu-central-1) |
| Anthropic Ireland, Limited | Large language model inference (Claude API) | United States — Standard Contractual Clauses |
| Cloudflare, Inc. | DNS and domain management; network relay (TURN) for the mobile app's voice-agent feature on constrained networks, when a direct connection cannot be established | Global network — EU-US Data Privacy Framework and Standard Contractual Clauses |
| Deepgram, Inc. | Conversational voice AI (speech-to-text) | European Union (EU endpoint) — Standard Contractual Clauses |
| ElevenLabs, Inc. | Conversational voice AI | European Union (EU data residency) — EU-US Data Privacy Framework and Standard Contractual Clauses |
| Google Ireland Limited (Google Workspace) | Email for the data-protection contact mailbox | European Union |
| Hound Technology, Inc. (Honeycomb) | Telemetry and observability | European Union (EU1) |
| Langfuse GmbH | AI-model observability and tracing | European Union — Ireland (eu-west-1) |
| Meta Platforms Ireland Limited | WhatsApp Business Platform (in combination with Twilio) | European Union and United States (Meta data centres) — EU-US Data Privacy Framework and Standard Contractual Clauses |
| Mistral AI SAS | Large language model inference (La Plateforme) | European Union — EU-hosted inference |
| OpenAI Ireland Ltd | Large language model inference | European Union (EU data residency) — Standard Contractual Clauses |
| Twilio Ireland Limited | Voice telephony, phone numbers and WhatsApp connectivity | European Union — Ireland (IE1) for voice and SMS; United States for WhatsApp — EU-US Data Privacy Framework and Standard Contractual Clauses |
| WorkOS, Inc. | Authentication and identity (SSO) | United States — Standard Contractual Clauses |
Avatia will notify the controller of any change to this list — the addition or replacement of a sub-processor — in accordance with the procedure and timeframes set out in the sub-processing clause of the Agreement.
For any question regarding sub-processors, please contact dpo@avatia.ai.