Last updated August 25, 2026
echowin engages the third parties below to help deliver the echowin Service. Each one Processes Customer Personal Data (as defined in our Data Processing Addendum) on echowin's behalf and under written terms no less protective than those in the DPA.
To be notified in advance when we add or replace a subprocessor, subscribe using the form at the bottom of this page, or email privacy@echo.win and ask to be added to the subprocessor change notification list. We provide at least 30 days' notice before a new subprocessor begins Processing Customer Personal Data.
| Subprocessor | Location(s) of processing | Purpose / description of processing |
|---|---|---|
| Cloudflare, Inc. (US) | Global edge network; storage and databases run on Cloudflare's global/automatic region setting | Primary application platform. Runs the backend services and holds live call and chat session state; stores call recordings and audit logs; caches configuration and phone-number data; brokers all database connections; queues background jobs; collects application logs and performance telemetry; serves uploaded images; performs or proxies AI inference where a Cloudflare-hosted model is selected |
| Google LLC (Google Cloud Run, US) | United States | Hosts the echowin web application, dashboard, and customer portal. Stores build artifacts and application secrets |
| Supabase, Inc. (US) | United States. Supabase hosts on Amazon Web Services infrastructure | Primary production database (PostgreSQL). Stores call records, transcripts, call summaries and analysis, contact records, knowledge base content and vector embeddings, and account data |
| Subprocessor | Location(s) of processing | Purpose / description of processing |
|---|---|---|
| Telnyx LLC (US) | United States | Carries inbound and outbound voice calls, provides phone numbers, performs call control and call recording, and sends SMS/MMS messages. Processes caller and recipient phone numbers, call audio, call metadata, and message content |
| Subprocessor | Location(s) of processing | Purpose / description of processing |
|---|---|---|
| Deepgram, Inc. (US) | United States | Real-time transcription of live call and web-voice audio |
| OpenAI, L.L.C. (US) | United States | Real-time transcription of live voice audio via the OpenAI Realtime API |
| Google LLC (Google AI / Gemini API) | United States | Real-time speech-to-speech processing of live call audio, and post-call transcription, summarization, and quality analysis of call recordings. Receives the call recording audio file |
| Subprocessor | Location(s) of processing | Purpose / description of processing |
|---|---|---|
| OpenAI, L.L.C. (US) | United States | Generates AI agent responses during calls and chats; generates embeddings for knowledge base content and search queries; generates speech audio |
| Anthropic PBC (US) | United States | Generates AI agent responses during calls and chats; processes uploaded documents and knowledge base content; generates call insights |
| Google LLC (Google AI / Gemini API) | United States | Generates AI agent responses; produces call summaries, transcripts, sentiment and quality analysis, and business-insight digests |
| Groq, Inc. (US) | United States | Generates AI agent responses when a Groq-hosted model is selected for an agent |
| Microsoft Corporation (Azure OpenAI Service) | United States | Generates AI agent responses when an Azure-hosted model is selected for an agent |
| OpenRouter, Inc. (US) | United States, and the locations of the inference endpoints OpenRouter routes to. echowin restricts routing to endpoints that neither retain nor train on request content, but OpenRouter does not guarantee a fixed geography for them | Routes AI inference requests to third-party model endpoints. Used to extract knowledge base content from customer webpages and documents, summarize chat conversations, generate agent instructions and prompts during automated setup, and generate outbound-campaign content |
Each of these Processes the text of the AI agent's spoken response, which may contain personal data (for example, a caller's name, address, or appointment details read back aloud).
| Subprocessor | Location(s) of processing | Purpose / description of processing |
|---|---|---|
| ElevenLabs Inc. (US) | United States | Generates agent speech audio, including custom cloned voices |
| Microsoft Corporation (Azure AI Speech) | United States | Generates agent speech audio |
| Google LLC (Cloud Text-to-Speech) | United States | Generates agent speech audio |
| OpenAI, L.L.C. (US) | United States | Generates agent speech audio |
| Deepgram, Inc. (US) | United States | Generates agent speech audio |
| Speechify Inc. (US) | United States | Generates agent speech audio |
| Theai, Inc. d/b/a Inworld AI (US) | United States | Generates agent speech audio, including custom voices |
| Subprocessor | Location(s) of processing | Purpose / description of processing |
|---|---|---|
| Resend, Inc. (US) | United States | Delivers transactional email, including call transcript and summary emails, notification emails, and account emails |
| Discord, Inc. (US) | United States | Receives internal operational alerts that include call metadata (partially masked caller and recipient phone numbers, call identifiers, agent and account names) and AI-generated call quality assessments |
| Mango Technologies, Inc. d/b/a ClickUp (US) | United States | Stores support tickets and internal support documentation, which may contain customer-supplied details about a call or account |
| PostHog, Inc. (US) | United States | Product analytics and error monitoring for the echowin dashboard and portal. Captures authenticated user identifiers, IP addresses, page and interaction events, and client-side exception payloads |
Where a customer connects their own account for one of the services below, that service is the customer's own vendor under Terms of Service §2.7. echowin transmits data to it at the customer's direction and under the customer's agreement with that provider.
Google Calendar · Microsoft Outlook / Microsoft Graph · Wix · Square · GoHighLevel · Shopify · Zapier · Slack · Discord (as a customer-connected channel) · Meta / WhatsApp Business · any customer-configured outbound webhook endpoint.
We'll email you at least 30 days before a new subprocessor begins processing customer personal data.