Where your data goes, and who protects it

Claude is the model behind the reasoning in our systems: reading enquiries, drafting replies, summarising calls. Anthropic's commercial terms include a GDPR data processing agreement with EU Standard Contractual Clauses, so nothing extra needs signing. It holds SOC 2 Type II, ISO 27001 and ISO 42001, the standard for AI management systems.

Anthropic does not train its models on anything sent through the API. That is a contractual commitment in its commercial terms, not a setting. Its own API processes data in the US. Where a client needs data to stay physically inside the EU, the same Claude models run through AWS Bedrock or Google Vertex AI in Frankfurt, Ireland, Paris or Stockholm.

Retell is the engine that answers and holds the call: it listens, thinks and speaks in real time. It is SOC 2 Type II and HIPAA audited, and offers a GDPR data processing agreement with Standard Contractual Clauses through its online signing portal, which we execute for every voice-agent account.

Recordings and transcripts are stored in the US; Retell does not currently offer EU hosting. We reduce what is held there with two per-agent controls: personal-data redaction, which strips names, numbers and addresses from stored transcripts, and an automatic deletion window so recordings are purged on a schedule rather than kept indefinitely.

Twilio provides the phone numbers and carries the calls to and from the voice agent. It is one of the most thoroughly certified vendors in this list: EU-US Data Privacy Framework, Binding Corporate Rules, ISO 27001, 27017 and 27018, SOC 2 Type II and PCI DSS Level 1. Its data processing agreement has been part of its standard terms since 2020.

Twilio offers an Ireland region so that call records and recordings can be kept inside the EU. Twilio does not delete recordings on its own, so we set a retention routine on each account rather than leave recordings to accumulate.

ElevenLabs generates the natural-sounding voice the agent speaks with. Its EU data controller is based in Warsaw, it is certified under the EU-US Data Privacy Framework, and its data processing agreement with Standard Contractual Clauses applies automatically to business accounts. It holds SOC 2 Type II, ISO 27001 and PCI DSS Level 1.

On standard plans ElevenLabs may use content to improve its models unless the "Data use" setting is switched off. We turn it off when an account is created. EU-only storage and zero-retention mode exist on Enterprise contracts if a project calls for them.

Railway hosts the servers and dashboards we build. It is SOC 2 Type II audited and certified under the EU-US Data Privacy Framework, with a data processing agreement that includes Standard Contractual Clauses. Railway's DPA is executed through its online form rather than applying automatically, and we complete that for our account.

Railway has an Amsterdam region, so a client's application and its stored data can be deployed to sit inside the EU.

Vercel hosts the public-facing websites and some web applications. It holds SOC 2 Type II, ISO 27001 and PCI DSS, is certified under the EU-US Data Privacy Framework, and its data processing agreement applies automatically on acceptance of its terms.

Server code can run in Dublin, London, Paris, Frankfurt or Stockholm. The default is a US region, so we set the EU region deliberately on projects that need it.

Supabase provides the database and login system behind our web applications. It is SOC 2 Type II and ISO 27001 certified, and its data processing agreement with Standard Contractual Clauses applies automatically on acceptance of its terms. A countersigned copy is available on request.

Each project is pinned to one data centre, and Supabase offers six in Europe including Ireland, London, Frankfurt and Zurich. This is a genuine data-location control: the database itself does not leave the chosen region.

GitHub, owned by Microsoft, stores the source code of what we build and deploys updates. It holds SOC 2 Type II and ISO 27001, is certified under the EU-US Data Privacy Framework, and its data protection agreement is built into its standard customer terms.

GitHub holds code, not customer records. Client data such as contact details, call recordings or CRM entries is never committed to a repository; it lives in the database, CRM and voice platforms listed elsewhere on this sheet.

GoHighLevel is the CRM that voice agents and outbound systems write leads and call outcomes into. It is certified under the EU-US Data Privacy Framework, backs that with Standard Contractual Clauses in its data processing agreement, and holds SOC 2 Type II and ISO 27001. The DPA applies automatically with the terms of service, and a copy can be downloaded from the account's compliance settings.

Data is hosted in the US with support teams in India; there is no EU hosting option.

Our systems connect to Google in two ways. Gmail and Calendar are Google Workspace services: Google acts as a processor under its Cloud Data Processing Addendum, which applies automatically, and both services are inside Google's SOC 2 and ISO 27001 scope. Google is certified under the EU-US Data Privacy Framework and can pin Workspace data to EU data centres on Enterprise plans.

Google Maps is used only to look up public business listings. For that service Google acts as an independent controller under separate Controller terms rather than as our processor. Any of our software that reads a client's Gmail or Calendar is also bound by Google's own API user-data policy, which limits use to the feature the client authorised.

Where a build takes payments, Stripe handles them. Card details never touch our systems. Stripe is the most regulated vendor here: PCI DSS Service Provider Level 1, SOC 1 and SOC 2 Type II, certified under the EU-US Data Privacy Framework with Standard Contractual Clauses as a fallback. Its data processing agreement is part of its standard services agreement.

UK and EU businesses contract with Stripe Payments Europe Ltd in Ireland as the regulated entity.

Slack, owned by Salesforce, receives alerts from our systems: a new booking, a missed call, a follow-up due. It is covered by the EU-US Data Privacy Framework, offers Standard Contractual Clauses to every customer, and holds SOC 2 Type II, ISO 27001 and ISO 42001. Its data processing agreement is a separate document executed online, which we complete for our workspace.

Calendly runs the links people use to book calls with us and, in some builds, with you. Its data processing agreement applies automatically on acceptance of its terms, it is certified under the EU-US Data Privacy Framework with Standard Contractual Clauses as a backstop, and it holds SOC 2 Type II and ISO 27001. Booking data is stored in the US.

Fathom records and transcribes our video calls so that requirements are captured accurately. It is certified under the EU-US Data Privacy Framework with Standard Contractual Clauses as a fallback, holds SOC 2 Type II and HIPAA, and its data processing agreement is incorporated into its terms. Recordings are stored in the US and summarised by AI providers that are contractually barred from training on the content.

Because it records, we tell everyone on a call that Fathom is running and stop it on request.