Subprocessor Register
Version 1.1 · 2026-09-03
Version 1.1 · effective 2026-09-03
This is the version in force. If we revise it, the new version appears here with a new number and date, and we give notice of material changes before they take effect. Ask us if you want to know how a clause works in practice, and we will tell you plainly.
Every vendor that may process your data, what it is reached for, and where its data processing agreement currently stands. Each row states its own position rather than asking you to take a blanket assurance on trust, because a register whose rows are not individually true is worth nothing.
| Vendor | Purpose | DPA status | Notes |
|---|---|---|---|
| Supabase Pte. Ltd | Database, authentication and storage | In force since 1 August 2026 | Version 1, incorporated by acceptance of the Supabase Terms of Service, clause 12.2. SOC 2 Type 2, ISO 27001 and HIPAA compliance claimed by the vendor. |
| Hyperdoc Inc. (Recall.ai) | Meeting capture and transcription (the notetaker bot) | In force, on acceptance of the agreement | Processes meetings the notetaker records, in the United States. Contractually barred from selling personal information or using it for anything but providing the service, and undertakes not to disclose it voluntarily to any government agency. Recordings are set to expire at the vendor within 72 hours and are deleted as soon as the transcript reaches us. |
| AssemblyAI Inc. | Transcription of uploaded files and browser recordings | In force, effective 22 January 2026 | Supplements the Terms of Service and binds on entering the Agreement, with no plan scoping. Reached only by recordings made in the browser or uploaded as a file: the notetaker bot's own recordings are transcribed by Recall. |
| Anthropic | AI extraction and analysis of transcripts | In force, effective 24 February 2025 | Incorporated into the Commercial Terms of Service. |
| Voyage AI Innovations Inc. | Embeddings for transcript chunks and Ask queries | In force, on the effective date of the agreement | Incorporated by acceptance of the Voyage AI Terms of Service, with no plan scoping. Contractually barred from using the data for any purpose outside providing the service, from combining it with another customer's, and from selling or sharing it. Server-side only. |
| Vercel Inc. | Application hosting | In force, version of 31 March 2026 | Incorporated into the terms, but scoped to Pro and Enterprise plans only. Pro plan confirmed 17 August 2026. |
| Plus Five Five, Inc. (Resend) | Transactional email | In force, version of 31 December 2025 | Incorporated by entering the Terms of Service, with no plan scoping. Meeting content never travels by email; the exposure is limited to what a digest line quotes. |
| Stripe, LLC | Subscription billing and credit purchases on the website | In force, version of 18 November 2025 | Forms part of the Stripe Services Agreement. No card data touches Routenna systems. |
Each vendor above is reached only for the purpose stated beside it, and for nothing else. Every row says whether the agreement is in force, with its date; if one ever says otherwise we will say so plainly rather than rounding it up to signed.
Two of these are worth knowing about specifically. The notetaker vendor processes the meeting itself, which makes it the vendor handling the most sensitive thing we hold; recordings there are set to expire within 72 hours and are deleted as soon as the transcript reaches us. Every vendor above processes your meeting content only on our instruction — though infrastructure vendors additionally hold their own account and service-usage records as controllers in their own right, governed by their own privacy policies, which is ordinary and which we would rather state than let you assume otherwise.