Subprocessors
Last updated: 2026-11-06
1. About this list
Voxgrid Inc (“sip.io”) uses the third-party service providers below (“Subprocessors”) to help deliver the Services. Each may process customer personal data on our behalf under the Data Processing Addendum. This page forms Annex III of the DPA.
We select Subprocessors after reviewing their security and privacy practices, bind them by written agreements with data protection terms at least as protective as our DPA (to the extent applicable to the service), and remain responsible for their performance. Our security measures for vendors are described in the Security Overview.
2. Infrastructure and platform subprocessors
| Name | Purpose | Data processed | Location | Transfer mechanism |
|---|---|---|---|---|
| Cloudflare, Inc. | Application hosting (Workers, Durable Objects), primary database (D1), object storage for recordings and media (R2), key-value storage (KV), queues, CDN, DDoS protection, Turnstile bot checks, private tunnel between edge servers and cloud, inbound email routing for SMS-to-email forwarding | All categories of customer personal data, including CDRs, recordings, transcripts, message content, account data, IP addresses | United States and European Union (storage); global edge network for transit | EU SCCs (Modules 2 and 3), UK Addendum; EU-U.S. Data Privacy Framework where certified |
| Oracle Corporation (Oracle Cloud Infrastructure, OCI) | Hosting of session border controllers (Kamailio), media relay (rtpengine) and IVR/queue servers (FreeSWITCH) | SIP signalling, call media in transit, IP addresses, device registrations, temporary recording buffers | United States (Ashburn), Germany (Frankfurt), Israel (Jerusalem), Asia-Pacific | EU SCCs, UK Addendum; EU adequacy decision for Israel |
| Google LLC (Google Cloud, GCP) | Hosting of session border controllers, media relays and IVR/queue servers in selected regions | SIP signalling, call media in transit, IP addresses, device registrations | Israel (Tel Aviv), Asia-Pacific, and other regions as deployed | EU SCCs, UK Addendum; EU-U.S. Data Privacy Framework; EU adequacy decision for Israel |
| Amazon Web Services, Inc. (AWS) | Cloud infrastructure (hosting of session border controllers and media servers in selected regions), DNS and email delivery (including the website contact-form notification email via Simple Email Service) | SIP signalling, call media in transit, IP addresses, device registrations; DNS queries; email addresses, names and message content of emails we send | United States, European Union (including Ireland, eu-west-1) and other regions as deployed | EU SCCs, UK Addendum; EU-U.S. Data Privacy Framework |
| Regional colocation and bare-metal partners (category) | Licensed colocation and bare-metal facilities hosting SIP signalling and media servers in regions where we do not use a cloud provider; used only for the real-time call path | SIP signalling and call media in transit (not stored at the node), IP addresses, device registrations. No account data, CDR archives, recordings or billing data | European Union and Israel today; further regions as deployed | EU SCCs where outside the EEA; EU adequacy decision for Israel |
3. Service subprocessors
| Name | Purpose | Data processed | Location | Transfer mechanism |
|---|---|---|---|---|
| DIDHub (part of the same corporate family as sip.io) | Wholesale provider of phone numbers (DIDs), number porting, and call and message termination | Phone numbers, CDRs, caller ID, KYC and end-user address data required for number assignment, call signalling and media in transit | The countries where numbers are assigned and calls are routed, including the United States, the European Union and Israel | EU SCCs, UK Addendum |
| X.AI LLC (xAI) | AI transcription and summaries of call recordings and voicemail, when enabled by the customer | Call recording and voicemail audio, transcripts, summaries | United States | EU SCCs, UK Addendum |
| Meta Platforms Ireland Ltd / Meta Platforms, Inc. (WhatsApp Business Platform) | Delivery of WhatsApp Business messages; only for customers that use WhatsApp | Phone numbers, WhatsApp profile data, message content and media, delivery status | European Union and United States | EU SCCs, UK Addendum; EU-U.S. Data Privacy Framework |
| Resend, Inc. | Transactional email (sign-in links, invoices, alerts, status page notifications, voicemail-to-email) | Email addresses, names, email content, which may include voicemail notifications or summaries | United States | EU SCCs, UK Addendum |
| HubSpot, Inc. | CRM, sales and support records, website contact form | Business contact details, communications history, support tickets | United States and European Union | EU SCCs, UK Addendum; EU-U.S. Data Privacy Framework |
| Our third-party payment processor | Payment processing for prepaid wallet top-ups and invoices (not yet active: accounts are billed directly by our team until card payments launch; this row will name the processor before it is used) | Name, billing address, payment card or bank details (held by the processor), transaction data | United States and other countries where the processor operates | EU SCCs, UK Addendum |
4. Upstream carriers and interconnect partners (category)
Calls and messages must be handed to other networks to reach their destination. We use a range of upstream voice carriers, SMS aggregators and interconnect partners, selected per destination for quality, cost and compliance. They process the phone numbers, signalling, caller ID, CDRs, media and message content needed to carry each communication, in the country of origin, the destination country, and transit countries along the route.
Because routing changes frequently and many of these providers act as independent electronic communications services under their own regulatory obligations, we list them by category rather than by name. A list of the principal carriers serving a particular region is available on request to privacy@sip.io, subject to confidentiality. Emergency calls are routed to emergency service providers and public safety answering points as required by law.
5. BYOC and customer-chosen services
If you connect your own carrier through a BYOC trunk, or connect a third-party integration through our API, webhooks or MCP server, those providers are chosen by you and are not our Subprocessors. You are responsible for your agreements with them. See BYOC Terms.
6. Subscribing to changes
We will give at least 30 days notice before a new Subprocessor begins processing customer personal data, by updating this page and emailing subscribers.
To subscribe, email privacy@sip.io with the subject “Subprocessor updates” from an address associated with your account, or enable subprocessor notifications in the console where available. Account owners are subscribed automatically. Each change is also recorded in our Legal Changelog.
7. Objecting to a new Subprocessor
If you have reasonable data protection grounds to object to a new Subprocessor:
- Email privacy@sip.io within the notice period, identifying your account and explaining your concern.
- We will acknowledge your objection and work with you in good faith to address it, for example by explaining the safeguards in place, or by offering a configuration that avoids the Subprocessor for your data (such as disabling AI transcription or WhatsApp).
- If we cannot resolve the objection, you may terminate the affected Services as set out in section 8.5 of the Data Processing Addendum.
8. Contact
Questions about our Subprocessors can be sent to privacy@sip.io.