The short version. This is the complete list of companies that may process Customer Data when you use Pazau. It is the list referenced in our Data Processing Addendum. Every AI model provider on this list operates under zero data retention and may not train on your data. We give customers at least 30 days' notice before adding or replacing a sub-processor, and you can object. Subscribe to updates below.
How this list works
A sub-processor is a third party, or a Pazau affiliate, that Pazau engages to process Customer Data on behalf of our customers. "Customer Data" has the meaning given in the Subscription Agreement and Data Processing Addendum. It includes the conversations, recordings, transcripts, attachments, and contact details your end customers send through Pazau.
Before we engage a sub-processor, we:
- complete a security and privacy review, including SOC 2 Type II or ISO/IEC 27001 evidence and, for AI providers, a model risk assessment under our ISO/IEC 42001 AI management system;
- sign a written agreement with data protection terms at least as protective as our DPA, including confidentiality, security, breach notification, deletion, and audit obligations;
- put an appropriate transfer mechanism in place for any transfer outside the EEA or UK;
- for AI model providers, contractually require zero data retention (no prompts or outputs stored beyond the time needed to return a response, apart from transient abuse-monitoring exemptions that we have waived) and a prohibition on using Customer Data to train or improve models.
Pazau remains responsible for each sub-processor's performance, as set out in the DPA.
Which sub-processors apply to you
Not every sub-processor processes every customer's data. Which ones apply depends on:
- Your data region. Customers on the EU region have Customer Data stored and processed in the EEA by the EU-region entries below. Some services, such as global edge networking and certain support tooling, necessarily involve limited processing outside the EEA. Those entries are marked.
- The products you use. Pazau Voice uses the speech providers and Twilio Voice, for example. Inbox-only customers do not.
- The features you enable. Channels like WhatsApp are processed only if you connect them.
Enterprise customers can restrict AI model routing to specific providers in Settings → AI → Model providers.
Abbreviations. SCCs: the EU Standard Contractual Clauses (Commission Decision 2021/914). UK Addendum: the UK International Data Transfer Addendum. DPF: the EU-U.S. Data Privacy Framework, UK Extension, and Swiss-U.S. DPF.
Infrastructure
| Entity | Purpose | Data processed | Location | Transfer mechanism |
|---|---|---|---|---|
| Amazon Web Services, Inc. (US region) | Cloud hosting, storage, databases, encryption key management (AWS KMS) | All Customer Data for US-region customers | United States: us-east-1 (N. Virginia), us-west-2 (Oregon) for disaster recovery | Not applicable for US customers; DPF and SCCs where EEA or UK data is involved |
| Amazon Web Services EMEA SARL (EU region) | Cloud hosting, storage, databases, AWS KMS, and Claude models through Amazon Bedrock for EU-region AI requests | All Customer Data for EU-region customers | Ireland: eu-west-1; Germany: eu-central-1 (Frankfurt) for Bedrock and disaster recovery | No transfer; data stays in the EEA. SCCs cover limited remote support access |
| Cloudflare, Inc. | Content delivery, DDoS protection, web application firewall, TLS termination for the Pazau messenger and APIs | Network traffic metadata (IP addresses, request headers); message content in transit only, not stored | Global edge network; EU customers use Cloudflare Data Localization Suite with EU-only TLS decryption | DPF and SCCs |
AI model providers
Every provider below is under zero data retention and a contractual no-training commitment. Pazau Guard redacts configured PII categories (such as card numbers, government IDs, and health identifiers) before any prompt leaves Pazau's environment.
| Entity | Purpose | Data processed | Location | Zero data retention | Transfer mechanism |
|---|---|---|---|---|---|
| Anthropic, PBC | Large language model inference (Claude) for Pazau Agent reasoning, drafting, summarization, and QA scoring | Conversation excerpts, Procedure text, Action results, and redacted customer context in prompts; model outputs | United States. EU-region requests are routed to Claude on Amazon Bedrock in eu-central-1 (see AWS above) | Yes | DPF and SCCs (US customers only; no EU-region transfer) |
| Microsoft Corporation (Azure OpenAI Service) | Large language model inference (OpenAI models) for Pazau Agent and Insights, and text embeddings for knowledge retrieval | Same as above; knowledge-base content for embeddings | United States: East US 2. EU: Sweden Central (EU Data Boundary) | Yes (abuse monitoring and content logging disabled under Microsoft's approved exemption) | DPF and SCCs for US; no transfer for EU region |
| Google LLC (Google Cloud Vertex AI) | Large language model inference (Gemini) for multilingual classification, translation, and fallback routing | Same as above | United States: us-central1 (Iowa). EU: europe-west4 (Netherlands) | Yes | DPF and SCCs for US; no transfer for EU region |
| Deepgram, Inc. | Real-time speech-to-text for Pazau Voice | Call audio streams and resulting transcripts | United States. EU: Deepgram EU endpoint (Germany) | Yes | DPF and SCCs for US; no transfer for EU region |
| ElevenLabs, Inc. | Text-to-speech voice synthesis for Pazau Voice AI agents | Text of AI agent responses to be spoken; no caller audio | United States. EU: ElevenLabs EU data residency (Netherlands) | Yes (zero retention mode) | SCCs for US; no transfer for EU region |
Communications
| Entity | Purpose | Data processed | Location | Transfer mechanism |
|---|---|---|---|---|
| Twilio Inc. | Voice calling, SIP trunking, call recording transport, and SMS for Pazau Voice and Inbox | Phone numbers, call audio, SMS content, call metadata | United States. EU: Twilio Ireland region (IE1) for media and recordings | DPF, SCCs, and Twilio Binding Corporate Rules |
| Twilio Inc. (SendGrid) | Delivery of outbound email replies and Pazau system notifications | Email addresses, email content and attachments, delivery metadata | United States. EU customers: SendGrid EU data residency (Germany) | DPF, SCCs, and Twilio Binding Corporate Rules |
| Meta Platforms, Inc. and Meta Platforms Ireland Limited (WhatsApp Business Platform, Cloud API) | Sending and receiving WhatsApp messages when you connect a WhatsApp Business account | WhatsApp phone numbers, profile names, message content and media | Meta global data centers; Cloud API local storage in the EU where enabled | DPF and SCCs. Meta acts as a processor for Cloud API message content |
Support and operations
| Entity | Purpose | Data processed | Location | Transfer mechanism |
|---|---|---|---|---|
| Zendesk, Inc. | Pazau's own customer support ticketing, when you open a support request with us | Contents of support tickets you send us, which may include Customer Data you choose to share (for example, a screenshot or conversation ID) | United States; EU customers' tickets hosted in Zendesk's EU data center (Germany) | DPF and SCCs |
| Datadog, Inc. | Infrastructure monitoring, application performance monitoring, and log management | Service logs and traces, with message content and configured PII redacted at the source; IP addresses and identifiers | United States (US1). EU: Datadog EU1 (Germany) | DPF and SCCs for US; no transfer for EU region |
| Functional Software, Inc. (Sentry) | Application error tracking | Error stack traces and request metadata, with message bodies scrubbed before transmission | United States. EU: Sentry EU region (Germany) | DPF and SCCs for US; no transfer for EU region |
| Snowflake Inc. | Data warehouse for usage metering, billing reconciliation, and aggregated Pazau Insights reporting | Conversation metadata (timestamps, channel, resolution outcome, topic labels) and pseudonymous identifiers; no raw message content | United States: AWS us-east-1. EU: AWS eu-central-1 (Frankfurt) | DPF and SCCs for US; no transfer for EU region |
| PagerDuty, Inc. | On-call alerting for production incidents | Alert metadata, which may include customer workspace IDs | United States | DPF and SCCs |
Affiliates
Pazau affiliates process Customer Data to provide support, operations, and engineering under the intra-group data processing agreement, which incorporates the SCCs and UK Addendum.
| Entity | Purpose | Data processed | Location | Transfer mechanism |
|---|---|---|---|---|
| Pazau, Inc. | Service provision, engineering, 24/7 support, and security operations (sub-processor where your contracting entity is Pazau Ireland Limited) | All categories of Customer Data, on a need-to-know basis | United States | DPF and intra-group SCCs |
| Pazau Ireland Limited | EU contracting entity, EU-region operations, follow-the-sun support, and Data Protection Officer function | All categories of Customer Data, on a need-to-know basis | Ireland | Not applicable (EEA); intra-group SCCs for onward transfers |
| Pazau UK Ltd | Follow-the-sun customer support and professional services | All categories of Customer Data, on a need-to-know basis | United Kingdom | EU adequacy decision for the UK; intra-group agreement |
Recent changes
We post changes here at least 30 days before a new sub-processor begins processing Customer Data, as required by the DPA. During the notice period you may object by emailing privacy@pazau.com with reasonable, data-protection-based grounds. We will work with you in good faith on an alternative, and if we can't agree, you may terminate the affected Services as described in the Data Processing Addendum.
| Date announced | Effective | Change |
|---|---|---|
| 2026-08-07 | 2026-09-08 | Added ElevenLabs EU data residency (Netherlands) for EU-region Pazau Voice customers. EU-region voice synthesis no longer leaves the EEA. |
| 2026-06-15 | 2026-07-16 | Added Google Cloud Vertex AI europe-west4 for EU-region multilingual classification and translation. |
| 2026-04-20 | 2026-05-21 | Added ElevenLabs, Inc. for Pazau Voice text-to-speech, replacing the previous in-house voice synthesis stack. |
| 2026-03-02 | 2026-04-02 | Expanded Snowflake to AWS eu-central-1 so EU-region usage and Insights data stays in the EEA. |
| 2026-01-12 | 2026-02-12 | Added Deepgram EU endpoint for EU-region Pazau Voice transcription. |
| 2025-11-03 | 2025-12-04 | Removed Mailgun Technologies, Inc. Outbound email consolidated on Twilio SendGrid. |
| 2025-09-22 | 2025-10-23 | Added Pazau UK Ltd as an affiliate sub-processor for follow-the-sun support from our London office. |
Changes that don't add a new entity or a new processing location, such as a provider's legal name change or a narrowing of the data processed, are recorded here without a notice period.
Subscribe to updates
Customers are entitled to at least 30 days' advance notice of any new or replacement sub-processor under the Data Processing Addendum. To receive those notices:
- Workspace owners and billing admins are subscribed automatically and receive notices by email and in the app.
- Anyone else at a customer, such as your privacy or procurement team, can subscribe by emailing privacy@pazau.com with the subject line "Subscribe: sub-processor updates" from a work address, or through the subscribe option in our Trust Center.
Each notice names the sub-processor, its purpose, the data it processes, its location, and the effective date. Questions about this list can go to our Data Protection Officer, Aoife Brennan, at dpo@pazau.com.
Other service providers
Pazau also uses vendors that do not process Customer Data, such as our CRM, payroll, and marketing tools. They process only information that Pazau controls as a controller, such as account user contact details and website analytics. They are described in our Privacy Policy and Cookie Policy rather than here.