1. How this list works
We engage the sub-processors below to host and operate the platform. Each is bound by a written data-processing agreement, receives only the data needed for its task, and is prohibited from using personal data to train AI models or for its own purposes.
Notification of changes. We will update this page and email the owner of every Customer workspace at least 30 days before adding or replacing a sub-processor. Customers may object as described in Section 6 of the DPA. To receive notifications at an additional address, email hello@dialogis.io.
Transfer mechanisms. "EU" means the data stays in the EU/EEA. "DPF" means the provider is certified under the EU-U.S. Data Privacy Framework (we verify certification against the official list at dataprivacyframework.gov). "SCCs" means the European Commission's Standard Contractual Clauses (2021/914) are in place.
2. Infrastructure and platform sub-processors
| Sub-processor | Purpose | Data processed | Location | Safeguard |
|---|---|---|---|---|
| Google Cloud EMEA Ltd (Google Cloud Platform), Ireland | Hosting of the platform: application servers (Cloud Run), PostgreSQL database with vector search (Cloud SQL), cache (Memorystore), file and object storage (Cloud Storage), secrets, logging and monitoring; Vertex AI for text embeddings and, where configured, Gemini language models | All Customer Content and Conversation Data, account data, logs | Frankfurt, Germany (europe-west3); Vertex AI model inference in EU regions where available, otherwise Google's global endpoints | EU; Google Cloud Data Processing Addendum incl. SCCs and DPF for any support access from outside the EEA |
| Amazon Web Services EMEA SARL, Luxembourg | Amazon Cognito: identity provider for sign-in to the admin platform (email/password and Google sign-in) and email verification codes; Amazon SES: sending and receiving transactional email; Amazon S3 and CloudFront: delivery of our public websites, the chat widget files and hosted pages under dialogis.io | Customer account identities and email addresses; website visitor technical data (edge logs) | Stockholm, Sweden (eu-north-1) and Ireland (eu-west-1); CloudFront edge caches worldwide serve only public files | EU; AWS Data Processing Addendum incl. SCCs and DPF for any support access from outside the EEA |
| Stripe Payments Europe, Ltd., Ireland (with Stripe, Inc., USA) | Subscription billing, payments, invoices, VAT-ID collection, customer billing portal | Customer billing contact, billing address, VAT number, payment method (card data is entered directly with Stripe), transaction history | Ireland; USA | Stripe Data Processing Agreement; SCCs; DPF. Stripe is also an independent controller for its own regulatory obligations |
3. AI model and content-processing sub-processors
| Sub-processor | Purpose | Data processed | Location | Safeguard |
|---|---|---|---|---|
| OpenAI, L.L.C., USA (contracting entity for EEA customers: OpenAI Ireland Ltd) | Large language models that generate a Mind's answers, route and refine queries, understand images in Knowledge Sources, and generate persona and behaviour prompts | End-User message, retrieved passages of Knowledge Sources, persona instructions, recent conversation history; images from Knowledge Sources | USA (EU data residency used where available) | OpenAI Data Processing Addendum; SCCs; API data is not used for training; abuse-monitoring retention only |
| Google LLC, USA (Gemini API) | Reading web pages, video and audio at URLs supplied as Knowledge Sources; test conversations in the admin platform; alternative language model where configured | Content of URLs supplied by the Customer; test messages by Authorised Users | USA | Gemini API Data Processing Addendum for paid services; SCCs; DPF; data is not used for training |
| ElevenLabs, Inc., USA | Speech-to-text (transcription of voice messages, uploaded audio and video, and live voice input), text-to-speech, real-time conversational voice agents, and Voice Clones created with the voice owner's explicit consent | Audio spoken or uploaded by End Users and Customers, transcripts, text of answers to be spoken, Voice Clone recordings and voice models | USA | ElevenLabs Data Processing Agreement; SCCs; data is not used for training |
| Mistral AI SAS, France | Optical character recognition of scanned documents and images in Knowledge Sources | Page images of documents uploaded by the Customer | France (EU) | EU; Mistral Data Processing Agreement |
| Apify Technologies s.r.o., Czech Republic | On the Customer's instruction: crawling of websites supplied as Knowledge Sources and import of the expert's public LinkedIn posts | URLs and public content the Customer asks us to import | Czech Republic (EU) | EU; Apify Data Processing Agreement |
| Jina AI GmbH, Germany | Fetching and converting web pages supplied as Knowledge Sources into text | URLs supplied by the Customer and their public content | Germany (EU) | EU; Jina AI Data Processing Agreement |
4. Messaging channel providers
These providers transport messages between End Users and Minds when a Customer connects a Channel. The Customer connects its own account with the provider; the provider processes data under its own terms and privacy policy as an independent service and is not a sub-processor of Dialogis.
| Provider | Channel | Data exchanged | Location |
|---|---|---|---|
| Meta Platforms Ireland Ltd | WhatsApp Business Platform; Instagram Messaging API | Message content, phone number or account identifier, profile name, delivery metadata | Ireland; USA (Meta relies on the DPF and SCCs) |
| Telegram FZ-LLC / Telegram Messenger Inc. | Telegram Bot API | Message content, Telegram user ID and username, voice messages | United Arab Emirates and Telegram's data centres worldwide |
5. Integrations selected by the Customer
When a Customer connects one of the following services, Dialogis sends the data the Customer configures (typically the End User's contact details, request summary and the relevant part of the conversation) to the Customer's own account with that service, on the Customer's instruction. The service acts for the Customer, not for Dialogis.
- CRM systems: HubSpot, Pipedrive, Raynet, Flowii, GramCRM, AutoCRM;
- custom webhooks to endpoints the Customer specifies;
- Google (sign-in with a Google account, at the Customer's choice).
6. Changes since the previous version
| Date | Change |
|---|---|
| 2 September 2026 | First published list. Compared with the providers named in the July 2026 privacy policy: Pinecone (vector database) and Hugging Face (embeddings) are no longer used; vector search now runs inside the EU-hosted database and embeddings are produced by Google Vertex AI in the EU. Workflow orchestration (Temporal) is self-hosted inside our Google Cloud project and is therefore not a sub-processor. |
7. Questions
Email hello@dialogis.io. Copies of the safeguards (SCCs, DPF certifications, provider data-processing terms) are available to Customers on request.