1. About this list
To deliver the Asteri platform we use a small number of third-party processors. They process personal data only for the service purposes described below. Where applicable, we use written data-processing terms or other contractual and privacy safeguards appropriate to the provider's role and the requirements of GDPR Art. 28, the UK Data Protection Act 2018, and other applicable law.
We notify customers of any material change to this list at least 30 days before the change takes effect. To subscribe to change notifications, email privacy@getasteri.com with the subject "Subscribe: Sub-Processor Updates."
2. Current sub-processors
| Provider | Purpose | Data | Region |
|---|---|---|---|
| ElevenLabs | Optional AI receptionist calls, speech processing and conversation tools. | Call audio, transcripts, caller details and relevant workspace context. New receptionist agents are configured with recording enabled and a 10-day provider retention setting; organization records and legal retention may differ. | Provider infrastructure selected for the configured account and service. |
| Radar Labs, Inc. | Address lookup, geocoding and geographic search. | Submitted address or search text, coordinates needed for the request and request metadata. | Provider-operated infrastructure; subject to the applicable service terms. |
| Fly.io | Backend workers, realtime services and application infrastructure. | Application data processed by hosted services, queued work, operational logs and request metadata. | Regions selected for the deployed services, with provider-operated supporting infrastructure. |
| Z.ai | Routed language-model inference, including fallback processing for supported AI features. | Prompt, relevant workspace context, tool results, generated responses and usage metadata. | Provider infrastructure selected through the configured AI routing service. |
| Stripe, Inc. | Payment processing (cards, ACH, subscriptions). Stripe Connect for service-business payouts. | Cardholder data (tokenized — never touches our servers), billing address, email, payment metadata. | United States (with global processing edges). |
| PlanetScale, Inc. | Managed Postgres database hosting (primary application database). | All customer records, organization data, communications, files metadata. | United States (US-East). EU residency available on request for Enterprise. |
| Cloudflare, Inc. | Object storage (R2) for files, photos, attachments, exports. Edge network and DDoS protection. | Uploaded files (invoices, estimates, floor photos, avatars, signed documents). | Global edge with US storage by default. Region restrictions available. |
| 650 Industries, Inc. (Expo) | EAS mobile build, submission and update delivery; startup-performance monitoring; bounded operational events; optional push-notification routing. | Project/app/build/update identifiers, device and operating-system metadata, persistent installation/session identifiers, startup metrics, bounded event fields, and push tokens when Expo push routing is used. Asteri disables resolved-URL and route-parameter export. | United States with globally operated service infrastructure. |
| Telnyx LLC | SMS / MMS messaging and voice calling. | Customer phone numbers, message contents, call audio/recordings, voicemail, delivery and call metadata. | United States. |
| Resend, Inc. | Transactional and marketing email delivery. | Recipient email, sender identity, subject, message body, delivery metadata. | United States. |
| OpenAI, L.L.C. | AI model inference and embeddings routed through Vercel AI Gateway for supported Asteri AI features. | Prompt, context, media, transcript, response, usage, and embedding content sent for the requested AI operation. | United States. |
| Hangzhou DeepSeek Artificial Intelligence Co., Ltd. | Routed language-model inference for supported Asteri text features. | Prompt, context, response, and usage content sent for the requested AI operation. | Provider infrastructure selected through Asteri's AI routing service. |
| Flespi.io (Gurtam) | Vehicle telemetry ingestion and fleet GPS tracking. | Vehicle GPS coordinates, telematics events (speed, idle, harsh events), device identifiers. | European Union / Lithuania. |
| Google LLC | Optional Google Sign-In, Calendar, Drive, Business Profile, Google Ads, and Data Manager integrations; Firebase Cloud Messaging; Maps SDK for Android; plus routed Gemini model inference for supported AI features. | User-authorized Google identity, Workspace, business-listing, advertising, and conversion data required by the selected integration; Android push-registration and delivery metadata; Maps SDK device, network, usage and crash metadata; or prompt, context, media, response, and usage content for a requested Gemini operation. OAuth tokens are stored encrypted. | United States (with global edges). |
| Sentry (Functional Software, Inc.) | Application error monitoring and performance telemetry. | Stack traces, request and device metadata, diagnostic context and breadcrumbs. Default personal-information collection is disabled where configured, and selected sensitive fields are filtered. Error content may still contain information associated with a user or workspace. | United States. |
| Vercel, Inc. | Web application hosting, edge delivery, and AI Gateway routing. | Server logs and request metadata, plus prompt, context, media, response, and usage content transiting AI Gateway for a requested AI operation. | Global edge with US primary region. |
3. International transfers
Where personal data is transferred outside the EEA, UK, or Switzerland, we rely on one or more of the following safeguards: Standard Contractual Clauses (SCC 2021/914), the UK International Data Transfer Addendum, the EU-U.S. Data Privacy Framework where the sub-processor is certified, or the customer's own explicit consent for ad-hoc transfers.
4. Data Processing Agreement
Our standard Data Processing Agreement is available to all customers on request. Email privacy@getasteri.com with the subject "DPA Request" and include your organization name. We counter-sign and return within 5 business days. EEA / UK / Swiss customers receive the SCC-annexed version by default.