Sub-processors
We use the providers below to deliver CustomWeb Agents, each under a data processing agreement. Where a provider offers it, we enable no-training / opt-out (and zero data retention where available) by default — see the matrix below.
Bring your own keys (BYOK)?Those opt-outs are yours to set — we don't change the no-training or retention settings on your own provider accounts.
For how we protect your data — encryption, hardened headers, and our A-rated security posture — see the security page.
Last reviewed: 2026-06-21· Live status read from each provider's status page (refreshed every few minutes).
Data handling at a glance
| Provider | No model training | Zero data retention |
|---|---|---|
| OpenAI | ||
| Anthropic (Claude) | ||
| Mistral AI | ||
| Google (Gemini) | ||
| Groq | ||
| OpenRouter | ||
| xAI (Grok) | ||
| Deepgram | ||
| AssemblyAI | ||
| ElevenLabs | ||
| Cartesia | ||
| Twilio |
✓ = enabled on our account. No model training: your data is never used to train the provider's models. Zero data retention: the provider stores no inputs/outputs (enabled where available; some offer it only on enterprise plans).
LLM
| Provider | Purpose & data | Region | Status |
|---|---|---|---|
| OpenAI API inputs not used for training; we set API call logging to Disabled (store=false) so prompts/outputs aren't retained; ZDR available on request. | Generates agent responses (selectable model). Conversation text sent during a turn. | United States | Operational |
| Anthropic (Claude) API inputs/outputs not used for training (Commercial Terms); 7-day default retention; ZDR on approval. | Generates agent responses (Claude). Conversation text sent during a turn. | United States | Operational |
| Mistral AI Training opt-out enabled — API calls not used to train Mistral's models; Labs disabled; EU-hosted, not subject to US CLOUD Act. | Generates agent responses — strongest EU fit. Conversation text sent during a turn. | European Union (Paris) | Status |
| Google (Gemini) Paid Gemini API / Vertex not used for training; EEA/UK/CH get the no-train policy across all tiers. | Generates agent responses (Gemini, paid API/Vertex). Conversation text sent during a turn. | Global (EEA/UK/CH: no-train all tiers) | Status |
| Groq Global Zero Data Retention enabled on our account — inputs/outputs not stored or used for training. | Low-latency LLM inference (selectable). Conversation text sent during a turn. | United States | Operational |
| OpenRouter Configured for no training — paid & free training disabled and prompts never published; zero-retention routing enabled (routes only to non-training/ZDR endpoints). | Model router for additional LLMs. Conversation text sent during a turn. | United States | Status |
| xAI (Grok) Zero Data Retention active on our account — API inputs not retained or used for training. | Generates agent responses (Grok, selectable). Conversation text sent during a turn. | United States | Status |
Speech-to-text
| Provider | Purpose & data | Region | Status |
|---|---|---|---|
| Deepgram Model Improvement Program opt-out applied on every request (mip_opt_out=true) — not used for training; SOC 2 Type II, GDPR-ready. | Transcribes caller speech in real time. Call audio + resulting transcript. | United States | Operational |
| AssemblyAI Pro/Enterprise not used for training; EU data residency + zero retention available; SOC 2 Type II. | Transcription (fallback / selectable). Call audio + resulting transcript. | United States / EU (Dublin) | Operational |
Text-to-speech
| Provider | Purpose & data | Region | Status |
|---|---|---|---|
| ElevenLabs Third-party LLM training contractually prohibited; library sharing opt-in disabled; Zero-Retention Mode available (enterprise); EU residency available. | Synthesizes the agent's voice. Response text + generated audio. | United States (EU residency available) | Operational |
| Cartesia Optional ZDR prohibits storage/logging/training; in-region inference; GDPR, SOC 2 Type II / HIPAA. | Synthesizes the agent's voice (selectable). Response text + generated audio. | United States (in-region available) | Operational |
Telephony & SMS
| Provider | Purpose & data | Region | Status |
|---|---|---|---|
| Twilio Carrier; does not use customer data to train AI; logs call data by default — Request Inspector and PII redaction are configurable; DPA auto-incorporated; IE1 region available for EU residency. | Phone numbers, call/SMS transport, recordings. Phone numbers, call metadata, audio, SMS content. | United States (Ireland/IE1 for EU) | Minor issues |
Payments
| Provider | Purpose & data | Region | Status |
|---|---|---|---|
| Stripe PCI-DSS; processor under DPA. | Billing and card processing. Billing contact + payment details (card data handled by Stripe, not stored by us). | United States | Operational |
Authentication
| Provider | Purpose & data | Region | Status |
|---|---|---|---|
| Clerk Processor under DPA. | User authentication & sessions. Account email, name, auth credentials. | United States | Operational |
Hosting & compute
| Provider | Purpose & data | Region | Status |
|---|---|---|---|
| Vercel Processor under DPA. | Hosts the web app & APIs. Request data in transit; no primary data store. | United States | Operational· 99.44% · 30d |
| Render Processor under DPA; sessions are in-memory, not persisted. | Hosts the real-time voice runtime. Live call audio in transit during a call. | United States | Operational· 99.44% · 30d |
Database
| Provider | Purpose & data | Region | Status |
|---|---|---|---|
| Supabase Processor under DPA; encrypted at rest. | Primary application database. Account, agent config, transcripts/recordings metadata (per retention). | United States | Operational |
Cache & rate limiting
| Provider | Purpose & data | Region | Status |
|---|---|---|---|
| Upstash Processor under DPA. | Rate limiting & ephemeral cache. IP/identifier counters; no conversation content. | United States | Operational |
| Provider | Purpose & data | Region | Status |
|---|---|---|---|
| Resend Processor under DPA. | Transactional & marketing email. Recipient email address & message content. | United States | Operational |
Questions about data processing or a copy of our DPA? Contact us. See also our Privacy Policy.