1. Overview
ORAVYS engages the sub-processors listed below to provide its voice intelligence services. This page is maintained in compliance with GDPR Article 28 and is updated at least thirty (30) days before any change to the sub-processor list takes effect.
Enterprise customers with a Data Processing Agreement (DPA) will also receive direct notification of any changes via the contact email specified in their DPA.
2. Current Sub-Processors
| Sub-Processor | Purpose | Data Location | Safeguards |
|---|---|---|---|
| Google Cloud Platform Google LLC |
Cloud infrastructure, compute, storage | EU (europe-west1, Belgium) | EU adequacy + SCCs, ISO 27001, SOC 2 Type II |
| Stripe Stripe, Inc. |
Payment processing (tokenized) | US / EU | PCI DSS Level 1, SOC 2 Type II, SCCs |
| SendGrid Twilio Inc. |
Transactional email delivery (e-mail address, message content) | US | SCCs in provider DPA |
| Cloudflare Cloudflare, Inc. |
Network security and bot protection (Turnstile challenge on the free check by e-mail); receives IP address and technical request data | Global network | SCCs in provider DPA |
| Google (Sign-in, Analytics) Google LLC |
Login with Google (optional); site statistics with IP anonymization, loaded only after analytics consent | US / EU | SCCs in provider terms; analytics off by default |
| Anthropic Anthropic, PBC |
Enterprise forensic reports only: drafts the text narrative from anonymized severity and confidence labels and generic module identifiers. Receives no audio, acoustic features, file names, names or e-mail addresses | US | Commercial API terms with DPA and SCCs; no training on API inputs under those terms |
No Third-Party AI Processing of Audio
ORAVYS does not use third-party AI services, external large language models, or cloud-based machine learning APIs to process your voice recordings. All voice analysis is performed by ORAVYS's own engine pipeline. The single exception concerns text, not audio: for Enterprise forensic reports, a narrative summary may be drafted by Anthropic's model from anonymized labels, as listed above, and the report records this method.
3. Change Notification Process
Before engaging a new sub-processor or replacing an existing one, ORAVYS will:
- Update this page at least 30 days before the change takes effect.
- Notify enterprise DPA customers directly via email.
- Provide enterprise customers with a reasonable objection period of at least 15 business days. If objections cannot be resolved, the enterprise customer may terminate the affected services without penalty.
4. Data Residency
By default, all voice data processing occurs within the European Economic Area (GCP europe-west1, Belgium). Enterprise customers may request EU-only data residency commitments via their DPA.
Stripe and SendGrid process limited data (payment tokens, email addresses) which may transit through US infrastructure. No voice recordings or analysis results are shared with these sub-processors.
5. Contact
For questions about our sub-processors or to request notification of changes, contact privacy@oravys.com.