Sub-processors

• Caller and recipient phone numbers
• Call audio in transit, and call recordings where recording is enabled
• SMS message content
• Business regulatory data submitted for 10DLC vetting (legal name, EIN, address)

SOC 2 Type II, ISO 27001. BAA in place for HIPAA-enabled workspaces.

• The phone numbers you enroll for reputation monitoring
• Calling activity associated with those numbers

SOC 2 Type II. Data used only for number-reputation and branded-calling services.

• Recipient email address and display name
• Message subject and body, including booking confirmations and account notifications

SOC 2 Type II. Sending domain is mail.revdesk.com.

• Voice audio streams for browser-bridged calls
• AI agent session metadata

SOC 2 Type II. BAA in place for HIPAA-enabled workspaces.

• Call audio, when a Gemini voice is selected. The model listens and responds to the audio itself, so no separate transcription step is involved
• For connected Google Calendar or Sheets: calendar events, selected sheet contents, profile, and email, only with your OAuth consent

SOC 2, ISO 27001. Content submitted to the Gemini API is not used to train Google's models. Vertex AI routing keeps HIPAA workloads under the Google Cloud BAA.

• Call audio. The Realtime model listens and answers in speech directly, and transcribes the conversation as it goes
• Knowledge-base content and agent search phrases, converted to embeddings for retrieval
• Admin tooling content, such as text submitted for translation or FAQ generation

SOC 2 Type II. API content is excluded from model training under the enterprise API terms.

• Call audio, processed transiently for transcription. Only where the workspace has transcript saving enabled.

SOC 2 Type II. BAA in place, so transcription remains available to HIPAA-enabled workspaces. Speaker labels are scoped to a single call; no voiceprint is created or stored.

• The AI's response text, converted to spoken audio and processed transiently

SOC 2 Type II. Content excluded from model training under the enterprise API terms.

• The AI's response text, converted to spoken audio and processed transiently

Content processed transiently for synthesis and excluded from model training.

• Text-only content for the specific tool invocation

SOC 2 Type II. API content excluded from training. Excluded from HIPAA-enabled workspaces.

• Application traffic served through our hosting
• Call recordings, voicemail audio, and uploaded files stored in Vercel Blob

SOC 2 Type II. Encrypted at rest, hosted in US regions on AWS.

• Account data, workspace content, contact records, call metadata, and transcripts

SOC 2 Type II, GDPR compliant. Encrypted at rest with automated encrypted backups.

• Aggregate counters and short-lived cache keys. No call content is cached.

SOC 2 Type II. Encrypted in transit and at rest.

• Job payloads for the tasks being run, which can include contact identifiers and message content

SOC 2 Type II. Payloads are retained only for the job-run history window.

• Stack traces, request context, and diagnostic metadata
• Identifiers such as a user or organization id where they appear in an error's context

SOC 2 Type II. Configured to scrub credentials and request bodies from captured events.

• Payment card information, stored by Stripe and never by us
• Billing address and email

PCI DSS Level 1 certified.

• Product usage events, pages viewed, and features used
• Browser, device, and approximate location derived from IP
• A pseudonymous identifier, and the account identifier once you are signed in

SOC 2 Type II. No call audio, transcript, or message content is sent to PostHog.

• The contact identifiers you submit for enrichment, such as name, company, and domain
• Enriched business-contact attributes are returned to us and cached against your contact record

Enrichment runs only on your instruction. Because enrichment returns data sourced from third parties, see the enrichment note on the sub-processor page for your notice obligations.