Sub-Processors
Last updated: 31 August 2026
fonea (kraftscale GmbH) uses the following sub-processors to provide its AI phone assistant service. Data processing agreements are in place with the sub-processors we use; the corresponding records are currently being completed and archived.
Current Sub-Processors
| Company | Purpose | Processing location | Registered office | Safeguards | ||||
|---|---|---|---|---|---|---|---|---|
| Supabase Inc. | Database, authentication, storage of all call content and recordings | Switzerland (Infomaniak Network SA infrastructure, Geneva) | USA | DPA, SCC | ||||
| Telnyx LLC | Telephony, SIP trunking, call delivery, SMS | Global | USA | EU-U.S. DPF (zertifiziert)¹, DPA | ||||
| Google LLC | Real-time speech processing during the call; call summaries; knowledge base (answers and embeddings) | Global | USA | EU-U.S. DPF (zertifiziert)¹, DPA | ||||
| Google Cloud³ | Operation of the voice bridge (Cloud Run), operational logs, Secret Manager | Zurich (`europe-west6`) | see footnote | DPA | ||||
| Vercel Inc. | Web hosting; AI gateway for call summaries | Global | USA | EU-U.S. DPF (zertifiziert)¹, DPA | ||||
| OpenAI Inc. | Call summary ("Pro" variant), via Vercel AI Gateway | Global | USA | SCC, DPA | ||||
| Resend (Plus Five Five, Inc.) | Delivery of summary emails (containing caller name, callback number, matter), authentication and invitation emails | EU (`eu-west-1`) | USA | DPA, SCC | ||||
| ElevenLabs Inc.² | Text-to-Speech (TTS), Speech-to-Text (STT) | EU | UK | UK adequacy decision (Federal Council) | KI-Sprachmodell (LLM) | Global | USA | — (not in use) |
Integrations on the Customer's instruction
These providers receive appointment data because the Customer has configured them. The Customer is the contracting party; fonea acts on their instruction.
| Provider | Purpose | Location |
|---|---|---|
| Cal.com | Appointment booking in the Customer's calendar | Provider-side |
| eTermin | Appointment booking in the Customer's system | Provider-side (Switzerland/EU) |
¹ *Certified under the EU–U.S. Data Privacy Framework (adequacy decision, Art. 45 GDPR), verified on 18 August 2026 at dataprivacyframework.gov. For non-certified providers, EU/UK Standard Contractual Clauses are in place (Art. 46 GDPR).*
² *This provider is not currently in use. The row appears here because use for the stated purpose is prepared; before any addition to the data path we notify customers under the terms below.*
³ *The cloud infrastructure is distinct from the AI models: the voice bridge runs in the Google Cloud Zurich region (`europe-west6`), while the AI models run via Google LLC (USA). The exact contracting entity for the cloud infrastructure is currently being confirmed against the contract documents and will be added here.*
Notes
Storage exclusively in Switzerland: All persistently stored data (customer data, transcriptions, call summaries, recordings, metadata) is hosted exclusively in Switzerland by Supabase on Infomaniak Network SA infrastructure (Geneva) — compliant with the GDPR and the Swiss FADP. Switzerland benefits from an EU adequacy decision and is recognised by the UK as an adequate country.
Transient processing: Telnyx, Google, OpenAI, and Vercel process data exclusively on a transient basis — data is processed in real time and not stored persistently. The safeguards for cross-border transfers are shown per provider in the table (EU-U.S. DPF or SCCs). Data is not used to train AI models.
Evidence:
- EU-U.S. DPF certifications (Google LLC, Vercel Inc., Telnyx): dataprivacyframework.gov/list
- Google — no use of inputs/outputs for product improvement in the paid service: ai.google.dev/gemini-api/terms
- Vercel AI Gateway — disallow prompt training: vercel.com/docs/ai-gateway/security-and-compliance/disallow-prompt-training
- OpenAI API — no use of API data for model training: openai.com/enterprise-privacy
- Supabase — hosting infrastructure: supabase.com/security
International transfers: Where a provider processes data outside the EEA/UK (Art. 44 ff. GDPR), transfers are covered by an adequacy decision — such as the EU–U.S. Data Privacy Framework for certified providers — or by appropriate safeguards under Art. 46 GDPR (in particular EU/UK Standard Contractual Clauses), in addition to the Data Processing Agreement in place with each provider.
Changes to this list: We will notify our customers at least 30 days in advance of any changes. Customers may object to new sub-processors in accordance with the provisions of the DPA.
Contact
For questions about our sub-processors: privacy@fonea.ai