Sub-processors explained in plain English

When you use Agentric, parts of the service run on other companies' infrastructure — the telephony provider that carries calls, the cloud hosting the database lives in, the payment processor. In GDPR terms, these are sub-processors — third parties we engage to process data on your behalf.

Why the list exists and what it means

Your DPA with us requires transparency about who touches the data — so we publish the full sub-processor list at /subprocessors, keep it current, and give you objection rights when it changes. It's not boilerplate; it's your due-diligence record.

What's on the list (the categories)

• Cloud hosting/database — where the application and data physically live.
• Telephony providers — carries and terminates calls (e.g. Twilio-class infrastructure; the specific provider per your number is in your settings).
• AI model providers — the LLM and speech services powering the assistant. Our agreements with them prohibit training on your data.
• Email delivery — transactional email (confirmations, notifications).
• Payments — Stripe processes billing; we never see card details.
• Analytics/monitoring — operational telemetry only where consented.

What to actually check

For most small businesses the honest version is:

1. Is the list public and maintained? (Ours is.)
2. Do the categories make sense? (Calls need a telephony company; emails need an email company.)
3. Are data transfers handled lawfully? (Where any sub-processor is outside UK/EEA, the DPA requires safeguards — SCCs or equivalent.)
4. Can you object to changes? (Yes — the DPA provides for it.)

UK/EU residency

Where practical we prefer UK/EU-resident processing. For components that are inherently global (telephony termination is wherever the call lands; some AI infrastructure is US-based under contractual safeguards), the DPA spells out the safeguards rather than pretending otherwise — the honest answer about where data goes.

Your side of it

If your customers ask "who sees my call recording?", the honest answer is: us under our DPA, and the sub-processors on the list — each bound by their own obligations, for the stated purposes only. That transparency isn't a weakness; it's exactly what UK GDPR asks for and what a well-run SaaS looks like.