Sub-Processor List
This page lists the third-party sub-processors VantaWeb engages to deliver its services, published in fulfillment of our GDPR Article 28(3)(d) transparency obligations.
VantaWeb uses the following sub-processors to deliver its services. Sub-processors are third-party companies that process personal data on our behalf under written data processing agreements.
We will provide 30 days advance written notice by email and by updating this page before adding any new sub-processor that handles personal data.
Last updated: 2026-05-24
Current sub-processors
| Sub-processor | Role | Data processed | Location | DPA / Privacy |
|---|---|---|---|---|
| Anthropic, PBC | LLM inference (Anna reasoning and response generation) | Call transcripts, conversation context | United States | Anthropic DPA |
| Deepgram, Inc. | Speech-to-text transcription | Call audio, transcripts | United States | Deepgram DPA |
| Cartesia AI, Inc. | Text-to-speech voice synthesis | Anna response text (no caller PII transmitted) | United States | Cartesia Privacy — DPA available on request via privacy@cartesia.ai |
| LiveKit, Inc. | Real-time audio transport (WebRTC infrastructure) | Call audio streams | United States East | LiveKit DPA |
| Telnyx LLC | Telephone carrier / call routing / call recording | Caller phone numbers, call audio, call metadata | United States (Florida) | Telnyx DPA |
| Cloudflare, Inc. | CDN, DDoS protection, DNS, R2 object storage | IP addresses, request logs | Global edge / US East origin | Cloudflare DPA |
| Stripe, Inc. | Payment processing and subscription billing | Billing name, email, card last 4, billing address | United States | Stripe DPA |
| Clerk, Inc. | Authentication and session management | Email, name, session tokens | United States | Clerk DPA |
| Mem0 AI, Inc. | Conversation memory and vector embeddings | Call summaries, conversation embeddings | United States | DPA in review — contact privacy@vantaweb.io for current status |
| Netcup GmbH (US East VPS) | Infrastructure hosting (VPS, Manassas, Virginia) | All data at rest on VPS | Virginia, United States | Netcup Privacy Policy |
| Backblaze B2 / Cloudflare R2 | Backup and object storage | Database backups, call recording archives | United States | Backblaze Privacy / Cloudflare DPA |
| Hetzner Online GmbH | Voice agent infrastructure (Anna AI receptionist runtime) | Call audio (via Deepgram STT), conversation transcripts, and LLM inference context processed by Anna on the voice runtime | Ashburn, Virginia, United States | Hetzner Privacy / DPA |
Change notice process
Before adding a new sub-processor or materially changing how an existing sub-processor handles personal data, VantaWeb will:
- Update this page with the proposed addition or change.
- Email all active clients at least 30 days before the change takes effect.
- Allow clients who object to terminate with a prorated refund per the Data Processing Agreement.
Contact
Questions about sub-processors or data processing practices: privacy@vantaweb.io
See also: Data Processing Agreement | Privacy Policy | Data Retention Policy
This sub-processor list is reviewed and updated as our service providers change. Last reviewed 2026-05-24.