See pricing →
QuantyQuantyBETA
ProductIndustriesCompanyPricing
Talk to usRequest access

Sub-processors

Version 1.4 · 04.10.2026

This page lists every provider we entrust with processing our customers’ data, with its role, where it processes and the safeguard for any transfer outside the European Economic Area. The list is part of the data processing agreement (Annex B). If you are our customer, accepting the terms of service gave general authorisation for these providers, and you can object to changes.

1. How this list changes

We give at least 30 days’ notice before adding or replacing a sub-processor. Where our provider gives us a shorter period, we pass the notice on within 7 days of receiving it.

A customer may object within 30 days on data protection grounds. We then look for a solution, and if none is found the customer may drop the affected feature without extra charge.

To receive change notices, write to dawid@pluscode.io with the subject "subprocessors" and the address for notices. We store it for that purpose only and remove it on request.

2. Infrastructure, whole service

Amazon Web Services EMEA SARL, Luxembourg, with its affiliates. Role: hosting for the application and database, file storage, outgoing and incoming email (Amazon SES), user authentication (Amazon Cognito), AI models for in-app features (Amazon Bedrock). Location: eu-central-1 Region (Frankfurt, Germany). Transfer: data is stored in the EU; model requests may be routed to AWS Regions outside the EEA under the Standard Contractual Clauses incorporated in the AWS data processing addendum.

Amazon Web Services EMEA SARL, Luxembourg, AWS End User Messaging SMS (the service formerly branded Amazon Pinpoint SMS). Role: sending one-time SMS codes as a second factor for signing in. Data: the mobile phone number a user registered, the message carrying the code, delivery metadata (timestamp, delivery status). Location: eu-central-1 Region (Frankfurt, Germany). Transfer: processing stays in the EU, under the AWS data processing addendum. The message is then delivered by the recipient’s mobile network operator; for the delivery it is an independent controller and is not our sub-processor.

3. Payments

Stripe Payments Europe, Limited, Ireland, with Stripe, Inc., USA. Role: taking payments, subscriptions, invoices. Data: customer billing data and payer data. Stripe receives no content entered into Quanty and no call data. Transfer: EU-US Data Privacy Framework and the Standard Contractual Clauses. To the extent payment services law requires, Stripe acts as a separate controller.

Exa Labs, Inc., USA. Role: web search started by a user in an AI column or in chat. Data: the query text, written by the user or by their configuration. Transfer: Standard Contractual Clauses; we are verifying the provider’s transfer documentation. Until that is finished we do not recommend using search on special category data and we do not enable it on AI Secretary tables.

5. AI Secretary

The providers below process data only where a customer uses the AI Secretary module.

Amazon Web Services EMEA SARL, Luxembourg, already listed in section 2. Role: answering the AI Secretary’s calls: Quanty’s phone gateway on our servers in AWS, speech recognition (Amazon Transcribe), running the conversation, the call summary and the data extraction with a Claude model on Amazon Bedrock, and speech synthesis (Amazon Polly). Data: the caller’s voice, the transcript, the calling and the called number, information given during the call. Location: eu-central-1 Region (Frankfurt, Germany); conversation-model requests are processed only in AWS Regions in the EU. Transfer: processing stays in the EU, under the AWS data processing addendum. The call audio is not recorded; the transcript is kept in Quanty for the period the customer sets.

The number the AI Secretary answers on is the customer’s, at a VoIP or SIP provider of its choice. That provider carries the call to our gateway under the customer’s contract and is not our sub-processor. To sign in to that provider on the customer’s behalf, Quanty stores the SIP password, encrypted.

6. WhatsApp

The providers below process data only where a customer uses the WhatsApp module.

Amazon Web Services EMEA SARL, Luxembourg, AWS End User Messaging Social (the AWS service for the WhatsApp Business API). Role: carrying messages between the customer’s WhatsApp business number and the counterparty, and holding the link between our AWS account and the customer’s WhatsApp Business Account. Data: the customer’s WhatsApp business number and the counterparty’s phone number, the WhatsApp profile name the sender has set, the message text, any photo or document sent, message and delivery metadata (identifiers, timestamps, delivery and read status). Location: eu-central-1 Region (Frankfurt, Germany). Transfer: processing stays in the EU, under the AWS data processing addendum. Quanty stores no credential for this channel; sending is authorised by the AWS instance role.

Meta Platforms Ireland Limited, Ireland, with Meta Platforms, Inc., USA. Role: operating WhatsApp and the WhatsApp Business Platform; every message is delivered end to end through Meta’s infrastructure. Data: the business number and the counterparty’s phone number, the WhatsApp profile name the sender has set, the message text, any photo or document sent, message and delivery metadata (identifiers, timestamps, delivery and read status, and the pricing category Meta reports for each conversation). Location: Meta’s own infrastructure, including in the USA. Transfer: Standard Contractual Clauses; we are verifying the provider’s transfer documentation. Meta operates under its own terms for the WhatsApp Business Platform and engages its own further providers.

Amazon Web Services EMEA SARL, Luxembourg, Amazon Bedrock, already listed in section 2. Role: where an organization points its AI Secretary at a WhatsApp number, holding the conversation and extracting the fields. Data: the text of the conversation. Location: eu-central-1 Region (Frankfurt, Germany). Transfer: as in section 2.

Linking a WhatsApp Business Account requires Meta to verify the business. The number remains the customer’s.

Status at the date of publication: WhatsApp runs in production on a number linked to Quanty’s WhatsApp Business Account.

7. Website analytics

Google Ireland Limited, Ireland, with Google LLC, USA. Role: Google Analytics on quanty.ai, loaded only after analytics cookies are accepted. Transfer: EU-US Data Privacy Framework.

8. Providers started only by the customer

Google Ireland Limited (Gmail, Google Sheets) and Microsoft Ireland Operations Limited (Microsoft 365: Outlook, SharePoint, OneDrive): data reaches them only where the customer connects its own account and builds an automation or imports its own files. The customer then acts under its own agreement with those providers; they are not our sub-processors.

A customer’s own VoIP or SIP provider, including the one carrying the AI Secretary’s number: works under the customer’s contract.

A mailbox at another provider connected over IMAP and SMTP: works under the customer’s contract.

9. Change log

18.09.2026, version 1.0: first publication of the full list. Compared with the information previously scattered through the privacy policy, this adds Stripe, Exa, Eleven Labs, the model providers Eleven Labs engages, Twilio, and Amazon Cognito on the AWS side.

22.09.2026, version 1.1: two new uses of Amazon Web Services added. AWS End User Messaging SMS sends one-time SMS codes as a second factor for signing in (section 2). Amazon Chime SDK Voice Connector carries an inbound call to the AI Secretary where the customer connects a number through AWS (section 5). Both run in the eu-central-1 Region (Frankfurt) and the processing stays in the EU. We also added that the mobile network operator delivering a code, and the operator pointing a number at the SIP trunk, act as independent controllers and are not our sub-processors.

23.09.2026, version 1.2: WhatsApp added. Where a customer uses the WhatsApp module, message content travels through AWS End User Messaging Social in the eu-central-1 Region (Frankfurt) and through Meta, which operates WhatsApp and the WhatsApp Business Platform. Meta Platforms Ireland Limited, with Meta Platforms, Inc., is therefore a new sub-processor (section 6). Where an organization points its AI Secretary at a WhatsApp number, the text of the conversation is additionally processed by Amazon Bedrock; the channel is text and does not use the voice provider. The sections after the AI Secretary were renumbered: website analytics is now section 7, providers started only by the customer section 8, and this change log section 9.

28.09.2026, version 1.3: SharePoint and OneDrive added to the Microsoft services a customer can connect itself (section 8). Files imported from them are stored with the customer’s other files in Amazon Web Services in the eu-central-1 Region (Frankfurt). There is no new sub-processor.

04.10.2026, version 1.4: Eleven Labs, Inc., the model providers it engaged (Google Cloud and OpenAI), Twilio and the Amazon Chime SDK Voice Connector are removed. The AI Secretary now runs entirely on Amazon Web Services in the EU (section 5): Amazon Transcribe recognises the speech, a Claude model on Amazon Bedrock holds the conversation through EU Regions only, and Amazon Polly speaks. Amazon Web Services EMEA SARL is an existing sub-processor, so there is no new one. Section 8 now names the customer’s own VoIP or SIP provider, and the WhatsApp status line was brought up to date.

Later changes will be appended here with a date and a description.