Sub-processors
DRAFT — not legally binding
DRAFT — pending legal counsel review. Do not rely on this as legal advice.
Last updated: June 2026 · This list is updated as the architecture evolves.
Orqelo engages the following sub-processors to deliver the Service. Each sub-processor is bound by a data processing agreement with terms no less protective than those in our DPA. Enterprise customers will be notified at least 30 days in advance of any additions or replacements to this list.
To object to a sub-processor or request further information, contact legal@orqelo.com.
| Sub-processor | Category | Data processed | Region | Notes |
|---|---|---|---|---|
| Amazon Web Services (AWS) | Infrastructure | All customer and end-user data — database, file storage (S3), compute (EKS), KMS key management, SES email delivery | EEA (eu-west-1) primary; us-east-1 DR; me-south-1 MENA available on Enterprise | Primary cloud provider. All data encryption keys managed via AWS KMS. |
| Stripe, Inc. | Billing & payments | Billing contact name and email, payment method metadata (card type, last 4 digits, expiry, billing address), subscription and invoice records | US / Global | Full card numbers never reach our servers. Stripe handles PCI DSS compliance for payment processing. |
| OpenAI | AI inference | Conversation messages and context submitted to the AI for response generation (anonymised at the API boundary where feasible) | US | Used for GPT-family model inference. Subject to OpenAI's data processing terms. Enterprise customers may opt for a zero-data-retention API agreement directly with OpenAI. |
| Anthropic | AI inference | Conversation messages and context submitted to the AI for response generation (anonymised at the API boundary where feasible) | US | Used for Claude-family model inference. Subject to Anthropic's data processing terms. |
| Twilio, Inc. | Communications (optional) | Phone numbers, SMS message content, voice call metadata — only for tenants with the voice/SMS channel enabled | US / Global (regional routing available) | Only engaged when the voice or SMS channel is activated for a workspace. Not used for standard chat-only deployments. |
| LiveKit, Inc. | WebRTC / Real-time (optional) | Signalling metadata, session IDs, WebRTC media streams — only for tenants with the video/voice call feature enabled | US / Global (TURN server regions configurable) | Only engaged when the WebRTC call feature is activated. Media may transit LiveKit TURN infrastructure depending on network topology. |
| Cloudflare, Inc. | CDN / Network security | IP addresses, HTTP request metadata, TLS connection data — all traffic to and from the Service transits Cloudflare infrastructure | Global (EU PoPs available) | Used for DDoS mitigation, TLS termination, and static asset delivery. Cloudflare does not receive decrypted conversation content. |
| Datadog, Inc. | Observability / Monitoring | Application metrics, trace spans, structured log events — PII is minimised at the instrumentation layer before transmission | US | Used for infrastructure monitoring, error tracking, and performance tracing. Logs are scrubbed to remove PII before ingestion. |
| Sentry (Functional Software, Inc.) | Error tracking | Exception stack traces, request context, browser environment data — captured only on application errors | US | Used for real-time error reporting. PII scrubbing rules are applied; conversation content is excluded from error payloads. |
Architecture-dependent services
Twilio and LiveKit are used only for tenants that enable the voice/call channel feature. If your workspace does not use voice or WebRTC, neither service processes your data.
Data transfer safeguards
Where sub-processors are located outside the EEA or UK, transfers are conducted subject to appropriate safeguards including:
- Standard Contractual Clauses (SCCs) under GDPR Article 46(2)(c) — in place with AWS, Stripe, OpenAI, Anthropic, Twilio, LiveKit, Cloudflare, Datadog, and Sentry;
- Transfer Impact Assessments (TIAs) — completed or in progress for each sub-processor;
- Enterprise data residency (EU / MENA) ensures data-at-rest stays within the selected region; AI inference sub-processors may still receive anonymised prompt data depending on model provider data agreements.
Changes to this list
We will notify customers with active contracts of any additions or removals at least 30 days in advance. This page is updated on the effective date of the change.
Contact
Sub-processor questions: legal@orqelo.com