Sub-Processor List
Aelo uses the following sub-processors to provide its services. This list is maintained pursuant to GDPR Article 28(2) and our Data Processing Agreement with customers.
Customers are notified at least 30 days in advance of any new sub-processor being added, and may object in accordance with the DPA.
Audio Processing (ASR)
| # | Provider | Purpose | Data Processed | Location | Transfer Mechanism |
|---|---|---|---|---|---|
| 1 | ElevenLabs | Speech-to-text transcription (Scribe v2, default) | Audio recordings (voice data) | US | EU-US DPF + SCCs fallback |
| 2 | Deepgram | Speech-to-text transcription (alternate) | Audio recordings (voice data) | US | SCCs |
Data sensitivity: HIGH — Audio recordings contain voice data (potential biometric data). Each tenant is configured to use one ASR provider only.
AI Analysis (LLM)
| # | Provider | Purpose | Data Processed | Location | Transfer Mechanism |
|---|---|---|---|---|---|
| 3 | OpenAI | LLM analysis of transcripts | Transcripts (with PII redaction applied) | US | EU-US DPF + SCCs fallback |
Transcripts are sent to the LLM provider directly for analysis. OpenAI is the only LLM sub-processor; the OpenRouter gateway and Anthropic as an alternate provider are no longer used. PII redaction (phone numbers, emails, card numbers) is applied before any transcript is transmitted.
Authentication
| # | Provider | Purpose | Data Processed | Location | Transfer Mechanism |
|---|---|---|---|---|---|
| 4 | Clerk | User authentication and session management | User accounts (name, email), sessions, login events | US | EU-US DPF + SCCs fallback |
Data sensitivity: MEDIUM — No call content or transcripts. Only user account data.
Data Storage
| # | Provider | Purpose | Data Processed | Location | Transfer Mechanism |
|---|---|---|---|---|---|
| 5 | Neon | Primary database (PostgreSQL) | Transcripts, AI analyses, metadata, user data | EU (Frankfurt, eu-central-1) at rest; vendor is US-incorporated and may access data for support | EU-US DPF + SCCs fallback (covers vendor access, not storage) |
| 6 | Cloudflare | Infrastructure: R2 (audio storage), D1 (edge metadata), Workers (compute) | Audio files (R2), metadata (D1), all data in transit | EU at rest — R2 audio bucket in Western Europe, D1 metadata database in Eastern Europe; Workers execute at the edge location nearest the request | Cloudflare DPA + SCCs |
Where the data actually sits: both stores holding customer content are located in the European Union. The database region and the storage bucket region were verified against the live production configuration on 2026-08-02, not inferred from vendor defaults. Compute is the exception — a Worker runs at the Cloudflare edge location closest to the incoming request, so processing may occur outside the EU even though storage does not.
Communications
| # | Provider | Purpose | Data Processed | Location | Transfer Mechanism |
|---|---|---|---|---|---|
| 7 | Resend | Transactional email delivery (notifications, alerts) | Email addresses, delivery metadata. No call content. | US | EU-US DPF + SCCs fallback |
| 8 | SendPulse | Onboarding email automation — active only for a person who gave separate marketing consent at onboarding (Privacy Policy B.5) | Email address, onboarding metadata (name, locale, self-declared role, team size, industry, plan, signup source and date, and two behavioural milestone flags). No call content. | EU (Germany) — the SendPulse API endpoint resolves to Hetzner infrastructure in Falkenstein, Germany (verified 2026-08-02). SendPulse does not publish a per-account storage region, so this reflects the service endpoint rather than a contractual commitment. | SCCs retained (storage region not contractually confirmed) |
Data sensitivity: LOW — Only email addresses and onboarding metadata; no call content or transcripts.
Observability
| # | Provider | Purpose | Data Processed | Location | Transfer Mechanism |
|---|---|---|---|---|---|
| 9 | Langfuse | LLM observability (traces, cost tracking) — active only when observability is enabled | LLM traces, token counts, latency. No raw transcripts. | EU (Germany) | Not required (EU→EU) |
Data sensitivity: LOW — Operational traces only. No PII, no call content. Langfuse is an optional observability layer; when it is not enabled, no data is transmitted to it.
Application Monitoring & Error Tracking
| # | Provider | Purpose | Data Processed | Location | Transfer Mechanism |
|---|---|---|---|---|---|
| 10 | Sentry | Error tracking, performance tracing, and session replay for the Aelo web application and its API layer. Not applied to the background call-processing pipeline, which does not currently send data to Sentry. | Platform user's name, email address, and Aelo account identifier (for signed-in users); the connecting device's IP address, received by Sentry's ingest endpoint at the network level (not attached to events by the application — sendDefaultPii: false); the URL (path) of the page or API request associated with an error or trace; error messages and stack traces, which can incidentally include data being processed at the time of the error; breadcrumbs — a short log of recent in-app navigation, network requests, and console output leading up to an event; session replay recordings for a sample of browser sessions (approximately 10%), and for every session in which an error occurs, with on-screen text and form inputs masked and media blocked by default | EU (Germany) — the Sentry organisation is hosted in the EU region for both the browser SDK and the API layer; ingest endpoints resolve to ingest.de.sentry.io. Sentry's operating entity is US-incorporated and may access data for support. | SCCs (cover vendor access, not storage) |
Data sensitivity: MEDIUM–HIGH — unlike Langfuse above, Sentry receives the signed-in platform user's name, email address, and account identifier; the connecting IP address at the network level; breadcrumbs of recent navigation and network activity; and the URLs of pages and API requests. Session replay recordings mask on-screen text and block media by default, but URLs are not covered by that masking, and — beyond the roughly 10% sample — every session in which an error occurs is recorded. Error text is not filtered for content, so it can incidentally include data being processed at the time the error occurred.
Voice Analytics (Self-Hosted)
| # | Provider | Purpose | Data Processed | Location | Transfer Mechanism |
|---|---|---|---|---|---|
| 11 | Hetzner | Infrastructure hosting for Aelo's self-hosted acoustic service, which derives objective voice-delivery metrics (speaking rate, pauses, pitch variation, voice stability) from call audio | Audio recordings (voice data), processed transiently — no audio is retained by the acoustic service | EU (Germany) | Not required (EU→EU) |
Data sensitivity: HIGH — Audio recordings contain voice data (potential biometric data). The acoustic service is operated by Aelo on Hetzner infrastructure; it processes audio transiently (a temporary file that is deleted immediately after analysis) to compute metrics and does not retain recordings.
Alert & Notification Delivery
| # | Provider | Purpose | Data Processed | Location | Transfer Mechanism |
|---|---|---|---|---|---|
| 12 | Telegram | Alert & notification delivery via Telegram's Bot API — an individual platform user's personal alert channel (opt-in: the user links their own chat through a one-time link to Aelo's platform bot), and, independently, a project-level team channel an org admin configures to point at a Telegram group | Message text only, sent through Aelo's own bot account: rule name, severity, the record's channel and call category, and a link back to Aelo. No identity for either the other party to the call or the Aelo user associated with the record reaches Telegram — not a name, not a phone number, and not even a masked form of either — and no transcript excerpt or model-written explanation of why a rule fired. This applies to both personal and team destinations. Everything else stays in the platform, behind the recipient's normal access rights. | British Virgin Islands (Telegram Messenger Inc.); group companies in the BVI and Dubai, UAE | None offered — Telegram publishes no DPA and offers bot operators no SCCs (see below) |
Data sensitivity: MEDIUM — no identity for either the other party to the call or the Aelo user associated with the record is sent to Telegram in any form. The recipient's own Telegram account identifies that recipient to Telegram. Both Telegram destinations are opt-in: nothing is sent until the platform user links their own chat, or an org admin configures a destination group.
Telegram: what is and is not in place
We state this plainly rather than implying a protection that does not exist.
- Who the counterparty is. Telegram's Bot Platform Developer Terms of Service form an agreement with Telegram Messenger Inc., a company incorporated in the British Virgin Islands (BVI Business Companies Act 2004; registered office c/o Vistra (BVI) Limited, Wickhams Cay II, Road Town, Tortola). Telegram's Privacy Policy names its parent Telegram Group Inc. and Telegraph Inc., both in the BVI, and Telegram FZ-LLC in Dubai, UAE.
- Where the servers are. Telegram states that the data of users who signed up from the UK or the EEA is stored in third-party data centres in the Netherlands, on servers Telegram owns. That statement is scoped to where the Telegram account was registered; Telegram does not publish a storage location for bot traffic specifically, and a recipient who registered elsewhere is not covered by it.
- No data processing agreement. Telegram publishes no DPA for the Bot API and offers bot operators no Standard Contractual Clauses. Its Bot Platform Developer Terms state that the relationship establishes no agency, partnership or joint venture, and that Telegram has no affiliation with bot developers; the data-protection obligations in those terms run from the bot operator, not to it. Telegram's Privacy Policy correspondingly describes a user's messages to a bot as data the user sends to a third-party bot developer. There are therefore no Article 28 processor commitments, no audit rights, and no sub-processor list from Telegram covering this channel.
- No adequacy decision. Neither the British Virgin Islands nor the United Arab Emirates appears in the European Commission's list of countries and territories recognised as providing an adequate level of data protection.
- What we do instead. Because no contractual safeguard is available, we limit the channel rather than the paperwork: it is off unless you turn it on, it is per-chat, and the payload is reduced. Since 12 August 2026, a Telegram message — personal or team — carries the rule name, its severity, the record's channel and call category, and a link back to the record. It carries no identity for either the other party to the call or the Aelo user associated with the record: no name, no phone number, no masked form of either, no transcript excerpt, and not the model's own written explanation of why the rule fired. You can disable either destination at any time, after which nothing further is sent.
- Telegram's EEA representative. Telegram has designated the European Data Protection Office (EDPO), Avenue Huart Hamoir 71, 1030 Brussels, Belgium, as its representative under Article 27 GDPR.
If your organisation requires Article 46 safeguards for every recipient of personal data, do not enable Telegram delivery. Email, in-app notification, your own webhook and your own Bitrix24 chat remain available and are covered by the arrangements described elsewhere in this list.
Summary
| # | Provider | Data Risk | Location |
|---|---|---|---|
| 1 | ElevenLabs | HIGH (audio) | US |
| 2 | Deepgram | HIGH (audio) | US |
| 3 | OpenAI | HIGH (transcripts) | US |
| 4 | Clerk | MEDIUM (accounts) | US |
| 5 | Neon | HIGH (all data) | EU (Frankfurt) at rest; US vendor access |
| 6 | Cloudflare | HIGH (audio + metadata) | EU at rest (R2 Western Europe, D1 Eastern Europe); compute at the nearest edge |
| 7 | Resend | LOW (metadata) | US |
| 8 | SendPulse | LOW (contact + onboarding metadata) | EU (Germany) — endpoint verified, storage region not contractually confirmed |
| 9 | Langfuse | LOW (traces) | EU |
| 10 | Sentry | MEDIUM–HIGH (platform user identity incl. IP, page & API URLs, breadcrumbs, session replay; error text may incidentally include data being processed) | EU (Germany) — storage; US vendor access |
| 11 | Hetzner | HIGH (audio) — self-hosted acoustic service | EU (Germany) |
| 12 | Telegram | MEDIUM (recipient's own Telegram account; no other-party or Aelo-user identity in the message) | British Virgin Islands (group: BVI + UAE) |
Not Sub-Processors
| Integration | Why Not a Sub-Processor |
|---|---|
| Bitrix24 | Customer's own CRM. Aelo sends data to a Customer-configured webhook URL, and — using the Customer's own connected Bitrix24 integration — posts messages to a Bitrix24 group chat the Customer designates (for example, team alert delivery), both on the Customer's instruction. Bitrix24 is the Customer's processor, not Aelo's sub-processor. |
| Uspacy CRM | Customer's own CRM. For the separately activated Calls Beta, Aelo receives subscribed CRM activity events, resolves completed calls, retrieves the Customer-provided recording and minimum related metadata, and writes the resulting note or supported CRM comment back to the Customer's own Uspacy space on the Customer's documented instruction. Uspacy operates under the Customer's own arrangements and is the Customer's processor, not Aelo's sub-processor. |
| Bitrix24 (Aelo's own portal) | Our own Bitrix24 portal, which we use as our CRM and support desk. When a signed-in user writes to us through the in-app support chat, their name, email address, avatar image URL (when set), organization name, subscription tier — with the subscription status appended when it is not active, e.g. "Pro (past_due)" — role, organization identifier, the page the app was on when that identity was loaded, and the content of the conversation itself are passed to that portal so the operator can help without asking who is writing. This is personal data we process as controller for our own support purposes (see Privacy Policy, Section B.3), not Customer call data processed on a Customer's behalf — no transcripts, recordings, or analysis results are involved. |
| Stripe | Our payment processor for Aelo's own billing (subscriptions, prepaid top-ups, auto-recharge). When a billing customer record is created, Stripe receives the organization name, the initiating user's email address, and Aelo's internal organization identifier; card details are collected by Stripe directly and never reach Aelo. This is personal data we process as controller for our own billing purposes (see Privacy Policy, Section B.4), not Customer call data processed on a Customer's behalf — no transcripts, recordings, or analysis results are involved. |
| n8n | Self-hosted by tenant. Aelo sends webhook to tenant-provided URL. n8n processes data under tenant's control. |
Hosts the Customer designates in a fileUrl | Customer's own storage or telephony provider. When the Customer supplies a URL through the public API, Aelo opens an outbound connection to that address on the Customer's instruction and downloads the recording. The Customer chooses the host and controls what it serves; it holds the data under the Customer's own arrangements, not Aelo's. No additional sub-processor is involved in the retrieval itself: the hostname is resolved and the downloaded file is stored through Cloudflare (sub-processor #6 above, whose scope already covers R2 storage and all data in transit). |
| Customer-configured alert & notification webhooks | An endpoint the organization (project team channel) or an individual platform user (personal channel) configures to receive alert notifications. Aelo sends an HTTP POST to the organization- or user-designated URL on their instruction; the receiving system is operated under their own arrangements, not Aelo's. |
Change Notification Policy
- New sub-processor: Customers notified via email at least 30 days before processing begins
- Objection right: Customers may object within the 30-day notice period
- Removal: If objection cannot be resolved, customer may terminate the affected service
- Updates: Published at this URL and in the Aelo documentation
Contact
For questions about sub-processors or data processing:
Auspex Streamline S.L.
C.I.F.: B56341829
Calle Velarde 13, 4B
35010 Las Palmas de Gran Canaria
Canarias, Spain
Email: privacy@aelo.cloud
Document ID: SPL-Aelo-2026-001 · Version: 1.17