Sub-processors
Last updated: October 10, 2026
Respondo uses third-party service providers (sub-processors) to deliver its services. As a data processor under GDPR, we engage these sub-processors to perform specific functions on our behalf. This page lists all current sub-processors.
We notify customers at least 30 days in advance of any changes to this list. For details on how we handle data processing agreements, please refer to our Data Processing Agreement.
Current Sub-processors
| Provider | Purpose | Data Categories | Location | Certifications | DPA status | DPA link | Added |
|---|---|---|---|---|---|---|---|
| Clerk | Authentication & user management | Email addresses, user IDs, session data | United States / United Kingdom | SOC 2 Type II | Accepted via platform terms | View DPA | |
| Supabase | Database & file storage | All tenant and end-user data | EU (Dublin, Ireland) — eu-west-1 | SOC 2 Type II, ISO 27001, GDPR compliant | Accepted via platform terms | View DPA | |
| Stripe | Payment processing & subscription billing | Billing information, email addresses, payment method metadata | United States | PCI-DSS Level 1, SOC 2 Type II | Accepted via platform terms | View DPA | |
| Twilio | SMS & voice communications | Phone numbers, message content | United States (EU peering for EU-registered numbers) | SOC 2 Type II, ISO 27001 | Accepted via platform terms | View DPA | |
| Meta Platforms Ireland Ltd. (WhatsApp) | WhatsApp Business Platform (Cloud API) — sending and receiving WhatsApp messages on behalf of connected businesses | Customer phone numbers, WhatsApp message content and media, customer display names, message timestamps and delivery/read statuses, WhatsApp account identifiers (WABA ID, phone number ID) | Ireland (EU) | SOC 2 Type II, ISO 27001 (Cloud API) | Accepted via WhatsApp Business Data Processing Terms | View DPA | |
| Resend (Plus Five Five, Inc.) | Transactional email: consent requests and signed consent copies to the business's customers, the invoices and payment reminders the business sends, and booking-request summaries to the business | Recipient email addresses and names, consent signing links, signed consent PDFs (signer name, signature, signing audit trail), invoice PDFs (customer name and tax ID, lines, totals), booking requests (customer name, service, requested time) | United States | SOC 2 Type II | Accepted via platform terms | View DPA | |
| Anthropic | AI processing: clinical summaries, follow-up suggestions, assistant chat (Claude). Anthropic does not use customer data to train its models. | Session notes and appointment metadata submitted for generation | United States | SOC 2 Type II | Accepted 2026-04-22 (DPA effective 2025-02-24) | View DPA | |
| OpenAI | Conversation assistant: reads the WhatsApp and SMS messages a business's customers send and writes the replies, for every business with messaging connected. With AI features enabled, also data extraction from supplier invoices and audio transcription via Whisper. OpenAI does not train on API customer data; it keeps abuse-monitoring logs for up to 30 days, and audio is retained up to 30 days under OpenAI's default retention policy before deletion. | Inbound message text and recent conversation history, the customer's name and appointment details, the business's services; supplier invoices uploaded by the business; audio files submitted for transcription | United States | SOC 2 Type II | Signed 2026-04-22 (DPA v.010126) | View DPA | |
| TypeSafe AI, Inc. (System One) | Classifies the text of inbound customer messages to detect requests to stop receiving messages (opt-out), only for businesses where Respondo has switched this check on. TypeSafe states it does not train its models on the inputs it receives. | Text of the inbound message only (no name, phone number or conversation history) | United States | None published | Pending | Not published | |
| Vercel | Application hosting, CDN, scheduled jobs | Request logs, runtime data, cron execution logs | United States, EU (edge / functions in cdg1) | SOC 2 Type II | Accepted via platform terms | View DPA | |
| Sentry | Error tracking and performance monitoring (PII-masked) | Error stack traces, request metadata. User input is masked (`maskAllText` + `maskAllInputs`). | EU (de.sentry.io) | SOC 2 Type II, ISO 27001 | Accepted via platform terms | View DPA | |
| PostHog | Product analytics (opt-in) | Anonymous usage events. No clinical data. Cookie-gated. | EU (eu.i.posthog.com) | SOC 2 Type II | Accepted via platform terms | View DPA |
Changes to Sub-processors
We will notify customers at least 30 days before adding or replacing a sub-processor. If you object to a new sub-processor, you may terminate your subscription as described in our Terms of Service.
Questions
For questions about our sub-processors or data processing practices, contact us at privacy@hectormoyanovelez.com.