Sub-Processors
Last updated: 30 October 2026
rednea (kraftscale GmbH) uses the following sub-processors to provide its AI phone assistant service. Data processing agreements are in place with the sub-processors we use; the corresponding records are currently being completed and archived.
Current Sub-Processors
| Company | Purpose | Processing location | Registered office | Safeguards |
|---|---|---|---|---|
| Supabase Inc. | Database, authentication, storage of all call content and recordings | Switzerland (AWS Zurich, `eu-central-2`) | USA | DPA, SCC |
| Telnyx LLC | Telephony, SIP trunking, call delivery, SMS | EU | USA | EU-U.S. DPF (zertifiziert)¹, DPA |
| Google LLC (Vertex AI) | Real-time speech processing during the call; call summaries; knowledge base (answers and embeddings) | EU | USA | EU-U.S. DPF (zertifiziert)¹, DPA |
| Google Cloud³ | Operation of the voice bridge (Cloud Run), operational logs, Secret Manager | Zurich (`europe-west6`) | see footnote | DPA |
| Vercel Inc. | Web hosting | EU | USA | EU-U.S. DPF (zertifiziert)¹, DPA |
| OpenAI Inc. | Speech recognition (speech-to-text), AI language models (LLM) | EU (OpenAI EU data residency) | USA | SCC, DPA |
| Resend (Plus Five Five, Inc.) | Delivery of summary emails (containing caller name, callback number, matter), authentication and invitation emails | EU (`eu-west-1`) | USA | DPA, SCC |
| ElevenLabs Inc.² | Text-to-Speech (TTS), Speech-to-Text (STT) | EU | UK | UK adequacy decision (Federal Council) |
Integrations on the Customer's instruction
These providers receive appointment data because the Customer has configured them. The Customer is the contracting party; rednea acts on their instruction.
| Provider | Purpose | Location |
|---|---|---|
| Cal.com | Appointment booking in the Customer's calendar | Provider-side |
| eTermin | Appointment booking in the Customer's system | Provider-side (Switzerland/EU) |
¹ *Certified under the EU–U.S. Data Privacy Framework (adequacy decision, Art. 45 GDPR), verified on 18 August 2026 at dataprivacyframework.gov. For non-certified providers, EU/UK Standard Contractual Clauses are in place (Art. 46 GDPR).*
² *This provider is not currently in use. The row appears here because use for the stated purpose is prepared; before any addition to the data path we notify customers under the terms below.*
³ *The cloud infrastructure is distinct from the AI models: the voice bridge runs in the Google Cloud Zurich region (`europe-west6`), while Google's AI models run on Vertex AI in the EU. The exact contracting entity for the cloud infrastructure is currently being confirmed against the contract documents and will be added here.*
Notes
Storage exclusively in Switzerland: All persistently stored data (customer data, transcriptions, call summaries, recordings, metadata) is hosted exclusively in Switzerland by Supabase on AWS infrastructure in Zurich — compliant with the GDPR and the Swiss FADP. Switzerland benefits from an EU adequacy decision and is recognised by the UK as an adequate country.
Transient processing: Telnyx, Google, OpenAI, and Vercel process data exclusively on a transient basis — data is processed in real time and not stored persistently. The safeguards for cross-border transfers are shown per provider in the table (EU-U.S. DPF or SCCs). Data is not used to train AI models.
Evidence:
- EU-U.S. DPF certifications (Google LLC, Vercel Inc., Telnyx): dataprivacyframework.gov/list
- Google Vertex AI — no use of customer data for model training, processing in the selected region: cloud.google.com/vertex-ai/generative-ai/docs/data-governance
- OpenAI API — no use of API data for model training: openai.com/enterprise-privacy; EU data residency: openai.com/index/introducing-data-residency-in-europe
- Supabase — hosting infrastructure: supabase.com/security
International transfers: Where a provider processes data outside the EEA/UK (Art. 44 ff. GDPR), transfers are covered by an adequacy decision — such as the EU–U.S. Data Privacy Framework for certified providers — or by appropriate safeguards under Art. 46 GDPR (in particular EU/UK Standard Contractual Clauses), in addition to the Data Processing Agreement in place with each provider.
Changes to this list: We will notify our customers at least 30 days in advance of any changes. Customers may object to new sub-processors in accordance with the provisions of the DPA.
Contact
For questions about our sub-processors: privacy@rednea.ai