Sub-processors

Every vendor that touches your data

We use 26 sub-processors across infrastructure, AI, payments, email, and messaging. This page is the canonical list — what each does, what they see, and where they operate.

How sub-processors work in Spun

Always-on sub-processors handle core infrastructure (hosting, payments, WhatsApp gateway, email).
Optional sub-processors are engaged only when you enable the corresponding feature (specific AI providers, certain proxies, etc.). PII redaction (Maximum preset) and the master AI kill switch let you eliminate AI providers entirely.
We notify customers in advance of material changes to this list as required by our Data Processing Agreement.
To receive update notifications, email [email protected] with subject "Subprocessor updates".

Infrastructure & hosting

Run the servers, store the data, and route the traffic that powers Spun.

Sub-processor

Purpose

Data accessed

Region

Hetzner Online GmbH

Purpose

Primary application servers and PostgreSQL database

Data accessed

All Spun data at rest (encrypted disks)

Region

Nuremberg, Germany (EU)

Cloudflare, Inc.

Purpose

CDN, load balancer, WAF, DDoS protection, R2 object storage, TURN servers, Pages hosting

Data accessed

Encrypted HTTPS traffic; encrypted media binaries in R2; encrypted relay packets on TURN

Region

Global edge (PoPs near user)

netcup GmbH

Purpose

Regional cell servers (US region) and self-hosted real-time media nodes

Data accessed

Spun data at rest for organisations homed in the US region (encrypted disks); real-time audio and video relayed by the self-hosted media nodes

Region

Nuremberg, Germany (EU) and Manassas, Virginia (US)

WhatsApp gateway

Provides the API connection between Spun and WhatsApp.

Sub-processor

Purpose

Data accessed

Region

Whapi.cloud

Purpose

WhatsApp Business API gateway

Data accessed

All inbound/outbound WhatsApp message content, contact phone numbers, media

Region

EU / Cyprus

AI providers

Process messages for AI features when enabled. Disable via your AI settings or PII redaction presets — see the Privacy Overview.

Sub-processor

Purpose

Data accessed

Region

OpenAI, LLC

Purpose

AI compose, improve, summaries, smart replies, classification, search embeddings, Weave assistant, Whisper transcription

Data accessed

Message content (or PII-redacted version) per request. Not used to train OpenAI's models.

Region

United States

AssemblyAI

Optional

Purpose

Long-form audio transcription with speaker diarization

Data accessed

Audio file content per request

Region

United States

Deepgram

Optional

Purpose

Speech-to-text (Nova-3)

Data accessed

Audio file content per request

Region

United States

Speechmatics

Optional

Purpose

Speech-to-text (specialty languages)

Data accessed

Audio file content per request

Region

United Kingdom / EU

Microsoft Azure (Cognitive Services Speech)

Optional

Purpose

Fallback STT and TTS for specialty languages and dialects

Data accessed

Audio file or text per request

Region

EU / US (configurable)

Sarvam AI

Optional

Purpose

Indian-language STT and TTS

Data accessed

Audio or text content per request

Region

India

ElevenLabs

Optional

Purpose

High-quality text-to-speech

Data accessed

Text content per request

Region

United States / EU

Voice & video

Handle the live media for calls.

Sub-processor

Purpose

Data accessed

Region

LiveKit Cloud

Purpose

SFU for group calls and translation rooms with 3+ participants

Data accessed

Live audio/video media (decrypted by SFU to forward — see Encryption page)

Region

United States / global

Cloudflare TURN

Purpose

NAT-traversal relay for 1:1 WebRTC calls when direct P2P fails

Data accessed

Encrypted DTLS-SRTP packets only — TURN cannot decrypt media

Region

Global edge

Phone & SMS

Used for phone verification and the future phone-call AI agent.

Sub-processor

Purpose

Data accessed

Region

VitalPBX

Purpose

Self-hosted SIP PBX for voice OTP delivery

Data accessed

Phone number, OTP code at moment of call

Region

Self-hosted (Spun-owned, US data center)

BulkVS

Purpose

SIP trunk for outbound voice OTP delivery

Data accessed

Phone number, OTP code at moment of call

Region

United States

Authentication & push

Sign-in providers and mobile push notifications.

Sub-processor

Purpose

Data accessed

Region

Google (Sign-In with Google)

Purpose

OAuth identity provider for sign-in

Data accessed

Name and email at sign-in. We do not access Drive, Gmail, Calendar, or Contacts.

Region

United States

Firebase Cloud Messaging (Google)

Purpose

Push notifications for incoming messages and calls

Data accessed

Device push token, notification title/body (no message body unless the user enabled previews)

Region

United States

Payments & billing

Process subscription payments. Card data never reaches Spun servers.

Sub-processor

Purpose

Data accessed

Region

Stripe, Inc.

Purpose

Payment processing, subscriptions, invoicing, Stripe Connect for affiliate payouts

Data accessed

Customer name, billing email, billing address, card data (collected directly by Stripe Elements)

Region

United States (with EU data residency for EU customers)

Email & support

Send transactional email and provide in-app live chat support.

Sub-processor

Purpose

Data accessed

Region

SendGrid (Twilio)

Purpose

Transactional email: invitations, password resets, confirmation codes, notifications

Data accessed

Recipient email, message body for the specific email

Region

United States

Chatwoot

Optional

Purpose

Embedded live-chat widget on marketing site and in-app help

Data accessed

Chat messages with our support team, browser metadata

Region

EU / US (configurable)

WhatsApp routing (proxies)

Route WhatsApp connections through local-country IPs to improve deliverability.

Sub-processor

Purpose

Data accessed

Region

Spun relay servers (Self Proxy)

Optional

Purpose

Self-operated relay servers that carry Self Proxy WhatsApp connections between the WhatsApp gateway and the computer running your Self Proxy — the relay closest to that computer is used

Data accessed

TLS-encrypted WhatsApp gateway traffic only; relayed in real time, never stored

Region

Nuremberg, Germany (EU) and Manassas, Virginia (US)

Home proxy

Optional

Purpose

Residential proxies for WhatsApp connections in supported countries

Data accessed

Encrypted WhatsApp gateway traffic only

Region

Global proxy network

Monitoring & reliability

Track errors, monitor uptime, and aggregate operational logs. Operational logs include contact phone numbers, which we retain deliberately so support and engineering can trace a specific conversation. Credentials and email addresses are redacted before transmission, and message content is not routinely logged.

Sub-processor

Purpose

Data accessed

Region

Sentry (Functional Software, Inc.)

Purpose

Error tracking, performance monitoring, and cron job health checks

Data accessed

Stack traces, browser metadata, user email and org ID for error context. No message content.

Region

United States

Better Stack (Better Uptime, s.r.o.)

Purpose

Uptime monitoring and incident alerting for our public API endpoints

Data accessed

Availability probe results only (endpoint URL, HTTP status, response time). No customer data is sent.

Region

EU (Czech Republic)

Axiom, Inc.

Purpose

Centralised aggregation of server and container logs across our infrastructure

Data accessed

Operational log lines: timestamps, host and service names, request paths, error messages and stack traces, and contact phone numbers where they appear in an operational event. Credentials and email addresses are redacted before the logs leave our servers, and message content is not routinely logged. Retained for 30 days.

Region

EU (Frankfurt, eu-central-1)

Analytics

Marketing-site usage analytics. Spun the application itself does not run third-party analytics on customer data.

Sub-processor

Purpose

Data accessed

Region

Google Analytics

Optional

Purpose

Marketing-site visitor analytics (spun.com and country variants)

Data accessed

Anonymized page views and click events on marketing pages only

Region

United States

Need a signed DPA?

Our Data Processing Agreement is GDPR-aligned, includes EU Standard Contractual Clauses for international transfers, and covers all sub-processors listed above. Email [email protected] to request a copy.

See our compliance posture Back to privacy overview