Sub-processors
Last updated: October 26, 2026
Respondo uses third-party service providers (sub-processors) to deliver its services. As a data processor under GDPR, we engage these sub-processors to perform specific functions on our behalf. This page lists all current sub-processors.
We notify customers at least 30 days in advance of any changes to this list. For details on how we handle data processing agreements, please refer to our Data Processing Agreement.
Current Sub-processors
| Provider | Purpose | Data Categories | Location | Certifications | DPA status | DPA link | Added |
|---|---|---|---|---|---|---|---|
| Clerk | Authentication & user management | Email addresses, user IDs, session data | United States / United Kingdom | SOC 2 Type II | Accepted via platform terms | View DPA | |
| Supabase | Database & file storage | All tenant and end-user data | EU (Dublin, Ireland) — eu-west-1 | SOC 2 Type II, ISO 27001, GDPR compliant | Accepted via platform terms | View DPA | |
| Stripe | Payment processing & subscription billing | Billing information, email addresses, payment method metadata | United States | PCI-DSS Level 1, SOC 2 Type II | Accepted via platform terms | View DPA | |
| Twilio | SMS & voice communications | Phone numbers, message content | United States (EU peering for EU-registered numbers) | SOC 2 Type II, ISO 27001 | Accepted via platform terms | View DPA | |
| Meta Platforms Ireland Ltd. (WhatsApp) | WhatsApp Business Platform (Cloud API) — sending and receiving WhatsApp messages on behalf of connected businesses | Customer phone numbers, WhatsApp message content and media, customer display names, message timestamps and delivery/read statuses, WhatsApp account identifiers (WABA ID, phone number ID) | Ireland (EU) | SOC 2 Type II, ISO 27001 (Cloud API) | Accepted via WhatsApp Business Data Processing Terms | View DPA | |
| Resend (Plus Five Five, Inc.) | Transactional email: consent requests and signed consent copies to the business's customers, the invoices and payment reminders the business sends, and booking-request summaries to the business | Recipient email addresses and names, consent signing links, signed consent PDFs (signer name, signature, signing audit trail), invoice PDFs (customer name and tax ID, lines, totals), booking requests (customer name, service, requested time) | United States | SOC 2 Type II | Accepted via platform terms | View DPA | |
| Anthropic | AI processing: clinical summaries, follow-up suggestions, assistant chat (Claude), and the owner assistant, which answers the business's questions about its own clients, appointments, invoices and messages. Anthropic does not use customer data to train its models. | Session notes and appointment metadata submitted for generation; for the owner assistant, client names and contact details, appointments, invoiced amounts and message excerpts, sent when the business uses the assistant | United States | SOC 2 Type II | Accepted 2026-04-22 (DPA effective 2025-02-24) | View DPA | |
| OpenAI | Conversation assistant: reads the WhatsApp and SMS messages a business's customers send and writes the replies, for every business with messaging connected. With AI features enabled, also data extraction from supplier invoices and audio transcription via Whisper. OpenAI does not train on API customer data; it keeps abuse-monitoring logs for up to 30 days, and audio is retained up to 30 days under OpenAI's default retention policy before deletion. | Inbound message text and recent conversation history, the customer's name and appointment details, the business's services; supplier invoices uploaded by the business; audio files submitted for transcription | United States | SOC 2 Type II | Signed 2026-04-22 (DPA v.010126) | View DPA | |
| TypeSafe AI, Inc. (System One) | Classifies the text of inbound customer messages to detect requests to stop receiving messages (opt-out), only for businesses where Respondo has switched this check on. TypeSafe states it does not train its models on the inputs it receives. | Text of the inbound message only (no name, phone number or conversation history) | United States | None published | Accepted via platform terms | View DPA | |
| Vercel | Application hosting, CDN, scheduled jobs | Request logs, runtime data, cron execution logs | United States, EU (edge / functions in cdg1) | SOC 2 Type II | Accepted via platform terms | View DPA | |
| Sentry | Error tracking and performance monitoring (PII-masked) | Error stack traces, request metadata. User input is masked (`maskAllText` + `maskAllInputs`). | EU (de.sentry.io) | SOC 2 Type II, ISO 27001 | Accepted via platform terms | View DPA | |
| PostHog | Product analytics (opt-in) | Anonymous usage events. No clinical data. Cookie-gated. | EU (eu.i.posthog.com) | SOC 2 Type II | Accepted via platform terms | View DPA | |
| Verifacti (Bilbabit, S.L.) | Verifactu e-invoicing: sends the invoice records the business issues to the Spanish Tax Agency (AEAT) | Invoice records: the business's tax ID, invoice number, date, concept, tax lines and totals, and the recipient's name and tax ID | EU (European Economic Area) | None published | Signed by both parties on 29 October 2026 | View DPA | |
| ElevenLabs | Voice agent for missed calls, only for businesses that switch it on: answers the call the business could not pick up, tells the caller it is an AI and helps book an appointment. Call audio is not recorded; ElevenLabs keeps the call transcript. ElevenLabs may use models from Google, OpenAI or Anthropic as a backup. | Caller's voice during the call (not recorded), caller's phone number, call transcript, the business's name, services and available times, appointment details | United States | Not verified yet | Pending: accepted with the account terms | Pending |
Changes to Sub-processors
We will notify customers at least 30 days before adding or replacing a sub-processor. If you object to a new sub-processor, you may terminate your subscription as described in our Terms of Service.
Questions
For questions about our sub-processors or data processing practices, contact us at privacidad@respondo.es.