Sub-Processors List

Current Sub-Processors

Retell AI Sub-Processors

Retell AI, as our primary voice AI platform provider, engages the following sub-processors to deliver AI services. These sub-processors are documented in our Data Processing Addendum with Retell AI:

• OpenAI, L.L.C. - AI language models and natural language processing (United States)
• ElevenLabs - Voice synthesis and text-to-speech services (United States)
• Additional Retell AI sub-processors as documented in the Retell AI Data Processing Addendum

Data Storage and Transfer

EU Data Processing

Core infrastructure remains in the European Union:

• Primary data storage: MongoDB Atlas (Ireland, AWS eu-west-1)
• Backend infrastructure: Render Services (Frankfurt, Germany)
• All customer data and call recordings are stored and processed within EU regions
• All data at rest is encrypted using AES-256 or equivalent

International Data Transfers

Limited US transfers for specific services:

• Retell AI (AI processing), Twilio (telephony), Vercel (frontend delivery), Mailgun (emails)
• All US transfers are governed by Standard Contractual Clauses (SCCs)
• Transfer Impact Assessments completed for all US-based sub-processors
• Appropriate technical and organizational safeguards in place including:
  • Encryption in transit (TLS 1.2+) and at rest
  • Role-based access controls
  • Comprehensive audit logging
  • Security incident monitoring

Sub-Processor Change Notification

30-Day Advance Notice

We will provide at least 30 days' advance notice before:

• Adding a new sub-processor
• Replacing an existing sub-processor

How You Will Be Notified:

1. Email notification to your registered contact address
2. Update to this page with the change date clearly marked
3. Option to subscribe for email notifications by contacting info@bramforth.ai

Your Rights:

If you object to a new or replacement sub-processor on reasonable data protection grounds, you must notify us in writing within 30 days of our notification. We will work with you in good faith to address your concerns. If we cannot resolve your objection, you may terminate the agreement in accordance with its terms.

Data Processing Addendums

We maintain written Data Processing Addendums with all sub-processors listed above, ensuring they meet the same data protection standards we commit to in our customer agreements.

Copies of relevant sub-processor DPAs and our Transfer Impact Assessments are available upon request.

Security Certifications

Where applicable, our sub-processors maintain industry-standard security certifications:

• MongoDB: ISO 27001, SOC 2 Type II
• Twilio: ISO 27001, SOC 2 Type II
• Retell AI: SOC 2 Type II (upon request)

Contact Information

For questions about our sub-processors, to object to a proposed change, or to request additional information:

This list is maintained as part of our GDPR compliance obligations under Article 28.