Subprocessors
Last updated: April 15, 2026
Kazozo engages a small set of third-party vendors ("subprocessors") to help deliver our service. These vendors process customer data strictly under our instruction, under written agreements that require them to meet data-protection and security standards at least as strong as ours.
Infrastructure & hosting
| Subprocessor | Role | Data processed | Location |
|---|---|---|---|
| Amazon Web Services | Primary cloud hosting, database storage, object storage, backups | All customer data at rest and in transit | United States (us-east-1, us-west-2) |
| Cloudflare | CDN, DDoS protection, edge compute for widgets | IP address, request metadata, widget payloads in transit | Global edge network |
| GitHub | Source code hosting, static site deployment | No customer conversation data; public marketing site only | United States |
AI model infrastructure
| Subprocessor | Role | Data processed | Location |
|---|---|---|---|
| Anthropic | LLM inference (Claude Haiku, Claude Sonnet) for agent responses | Conversation messages during inference; not retained for training per zero-data-retention agreement | United States |
| OpenAI | Fallback LLM inference (GPT-4o-mini) during Anthropic outages | Conversation messages during inference; zero-retention API endpoint | United States |
| Deepgram | Speech-to-text for voice agents | Audio streams during active voice calls; not retained | United States |
| ElevenLabs | Text-to-speech for voice agents | Agent response text and generated audio | United States |
Communications & delivery
| Subprocessor | Role | Data processed | Location |
|---|---|---|---|
| Twilio | SMS, voice call routing, number provisioning (local presence) | Phone numbers, message bodies, call audio routing | United States |
| Postmark | Transactional email delivery | Email addresses, email content | United States |
Billing & payments
| Subprocessor | Role | Data processed | Location |
|---|---|---|---|
| Stripe | Payment processing, subscription billing, invoicing | Customer name, billing address, payment method token. Card numbers never touch Kazozo servers. | United States |
Product & analytics
| Subprocessor | Role | Data processed | Location |
|---|---|---|---|
| PostHog | Product analytics, feature flags, session replay (admin UI only) | Admin user events and IP; customer conversation content is excluded | United States (self-hosted) |
| Sentry | Error and exception monitoring | Stack traces, request IDs; message content is scrubbed before transmission | United States |
Notification of changes
We notify customers at least 30 days before engaging a new subprocessor or materially changing the role of an existing one. Customers can subscribe to subprocessor updates by emailing legal@kazozo.com with the subject "Subscribe to subprocessor updates."
If a customer has a reasonable, documented objection to a new subprocessor (for example, a compliance conflict), they may raise it during the notice period and we'll work in good faith to resolve it — up to and including an orderly exit if no alternative exists.
International data transfers
Where Kazozo or a subprocessor processes personal data of individuals in the EEA, UK, or Switzerland, transfers to the United States are made under the EU Standard Contractual Clauses (2021/914), the UK International Data Transfer Addendum, and — where applicable — the EU–US Data Privacy Framework. The current list of active frameworks is maintained as part of our DPA.
Questions about this list? Email legal@kazozo.com.