Sub-processors

Version 1.0 · 18.09.2026

This page lists every provider we entrust with processing our customers’ data, with its role, where it processes and the safeguard for any transfer outside the European Economic Area. The list is part of the data processing agreement (Annex B). If you are our customer, accepting the terms of service gave general authorisation for these providers, and you can object to changes.

1. How this list changes

We give at least 30 days’ notice before adding or replacing a sub-processor. Where our provider gives us a shorter period, we pass the notice on within 7 days of receiving it.

A customer may object within 30 days on data protection grounds. We then look for a solution, and if none is found the customer may drop the affected feature without extra charge.

To receive change notices, write to dawid@pluscode.io with the subject "subprocessors" and the address for notices. We store it for that purpose only and remove it on request.

2. Infrastructure, whole service

Amazon Web Services EMEA SARL, Luxembourg, with its affiliates. Role: hosting for the application and database, file storage, outgoing and incoming email (Amazon SES), user authentication (Amazon Cognito), AI models for in-app features (Amazon Bedrock). Location: eu-central-1 Region (Frankfurt, Germany). Transfer: data is stored in the EU; model requests may be routed to AWS Regions outside the EEA under the Standard Contractual Clauses incorporated in the AWS data processing addendum.

3. Payments

Stripe Payments Europe, Limited, Ireland, with Stripe, Inc., USA. Role: taking payments, subscriptions, invoices. Data: customer billing data and payer data. Stripe receives no content entered into Quanty and no call data. Transfer: EU-US Data Privacy Framework and the Standard Contractual Clauses. To the extent payment services law requires, Stripe acts as a separate controller.

4. Web search

Exa Labs, Inc., USA. Role: web search started by a user in an AI column or in chat. Data: the query text, written by the user or by their configuration. Transfer: Standard Contractual Clauses; we are verifying the provider’s transfer documentation. Until that is finished we do not recommend using search on special category data and we do not enable it on AI Secretary tables.

5. AI Secretary

The providers below process data only where a customer uses the AI Secretary module.

Eleven Labs, Inc., 169 Madison Ave #2484, New York, USA, with its affiliates including Eleven Labs Poland sp. z o.o. Role: speech recognition, running the conversation, speech synthesis, call summary and data extraction, temporary conversation history. Data: the caller’s voice, the transcript, phone numbers, information given during the call. Location: storage in the USA, processing in the USA, the EU or Singapore. EU data residency is available only on the Enterprise plan and we have not contracted it. Transfer: EU-US Data Privacy Framework and the Standard Contractual Clauses. Retention: 30 days by default.

Google (Google Cloud, Vertex AI), engaged by Eleven Labs. Role: running the Gemini and Claude language models. Data: the call text. Location: USA, EU or Singapore. Transfer: through Eleven Labs, under the EU-US Data Privacy Framework or the Standard Contractual Clauses.

OpenAI, engaged by Eleven Labs. Role: running GPT models where selected, and the automatic backup model. Data: the call text. Location: USA or EU. Transfer: through Eleven Labs, under the EU-US Data Privacy Framework or the Standard Contractual Clauses.

Twilio Ireland Limited, Ireland, with Twilio Inc., USA. Role: the phone number and call connection, only where Quanty provides the number. Data: calling and called numbers, call metadata, audio in transit, customer registration documents. Transfer: EU-US Data Privacy Framework, Twilio Binding Corporate Rules and the Standard Contractual Clauses. Twilio also processes some data as a separate controller, for abuse prevention and service improvement.

Eleven Labs engages its own further providers for infrastructure, moderation and support, listed at compliance.elevenlabs.io/subprocessors.

Status at the date of publication: the AI Secretary is not running in production and is not cleared to process health data.

6. Website analytics

Google Ireland Limited, Ireland, with Google LLC, USA. Role: Google Analytics on quanty.ai, loaded only after analytics cookies are accepted. Transfer: EU-US Data Privacy Framework.

7. Providers started only by the customer

Google Ireland Limited (Gmail, Google Sheets) and Microsoft Ireland Operations Limited (Microsoft 365, Outlook): data reaches them only where the customer connects its own account and builds an automation. The customer then acts under its own agreement with those providers; they are not our sub-processors.

A customer’s own Twilio account or its own SIP operator: works under the customer’s contract.

A mailbox at another provider connected over IMAP and SMTP: works under the customer’s contract.

8. Change log

18.09.2026, version 1.0: first publication of the full list. Compared with the information previously scattered through the privacy policy, this adds Stripe, Exa, Eleven Labs, the model providers Eleven Labs engages, Twilio, and Amazon Cognito on the AWS side.

Later changes will be appended here with a date and a description.