Data & privacy

Sub-processors

VoiceLayer is operated by Hastkari LLC. · Effective June 7, 2026

This page lists the third parties VoiceLayer engages to process Customer Data on our behalf, as referenced by our Data Processing Addendum. Each is bound by data-protection obligations no less protective than the DPA.

Infrastructure

Hosting, storage, and network.

Sub-processor	Purpose	Data processed	Location
Amazon Web Services (AWS)	Cloud compute, object storage, and database hosting (self-managed Kubernetes)	All Customer Data at rest and in processing (recordings, transcripts, metadata, account data)	United States
Cloudflare	Edge network, CDN, DNS, and DDoS/WAF protection	Request metadata, IP addresses, and traffic in transit	Global edge network (US-configured)

Communications

Telephony and real-time media.

Sub-processor	Purpose	Data processed	Location
LiveKit	Real-time media transport and SIP session handling	Live call audio in transit	United States
Twilio	PSTN telephony connectivity and phone numbers	Call audio, phone numbers, and call metadata	United States

Default AI provider

Used to process Customer Data only when you use VoiceLayer-provided model, speech-to-text, or text-to-speech defaults. If you bring your own provider keys (BYOK), your chosen provider is your sub-processor, not ours.

Sub-processor	Purpose	Data processed	Location
OpenAI	Large-language-model reasoning (default)	Transcripts and prompts for in-call reasoning	United States
Google (Gemini / Cloud)	Large-language-model reasoning and speech services (optional default)	Transcripts, prompts, and/or audio	United States
Deepgram	Speech-to-text transcription (default)	Call audio for transcription	United States
AssemblyAI	Speech-to-text transcription (optional default)	Call audio for transcription	United States
Cartesia	Text-to-speech voice synthesis (default)	Text for synthesis into agent speech	United States
ElevenLabs	Text-to-speech voice synthesis (optional default)	Text for synthesis into agent speech	United States

Platform

Authentication, monitoring, analytics, and email.

Sub-processor	Purpose	Data processed	Location
Clerk	Authentication, user identity, and organization management	Account identifiers, names, email addresses, authentication data	United States
Sentry	Error and performance monitoring	Diagnostic and telemetry data, which may incidentally include personal data	United States
PostHog Inc.	Product analytics for the web dashboard	Dashboard usage events, user and organization identifiers, and approximate location derived from IP	United States
Resend	Transactional email delivery	Recipient email addresses and message content	United States

Not our sub-processors: BYOK providers and carriers

The following are not VoiceLayer sub-processors:

BYOK providers. Model, speech-to-text, text-to-speech, and telephony providers that you select and configure with your own credentials act for you, not for us. You are responsible for the terms you accept with them.
Telecommunications carriers. Downstream carriers that originate or terminate calls act as independent providers under their own terms.

Changes to this list

We will provide at least 30 days’ advance notice before adding or replacing a sub-processor that processes Customer Data. You may object on reasonable data-protection grounds within 10 days, as described in the DPA; non-objection within that window is deemed acceptance.

To receive notice of changes to this list, contact [email protected].

Contact

Questions about this document? Reach us at [email protected] or write to Hastkari LLC, [Hastkari LLC — registered address, Texas, USA].