Sub-Processor List
Aelo uses the following sub-processors to provide its services. This list is maintained pursuant to GDPR Article 28(2) and our Data Processing Agreement with customers.
Customers are notified at least 30 days in advance of any new sub-processor being added, and may object in accordance with the DPA.
Audio Processing (ASR)
| # | Provider | Purpose | Data Processed | Location | Transfer Mechanism |
|---|---|---|---|---|---|
| 1 | ElevenLabs | Speech-to-text transcription (Scribe v2, default) | Audio recordings (voice data) | US | EU-US DPF + SCCs fallback |
| 2 | Deepgram | Speech-to-text transcription (alternate) | Audio recordings (voice data) | US | SCCs |
Data sensitivity: HIGH — Audio recordings contain voice data (potential biometric data). Each tenant is configured to use one ASR provider only.
AI Analysis (LLM)
| # | Provider | Purpose | Data Processed | Location | Transfer Mechanism |
|---|---|---|---|---|---|
| 3 | OpenAI | LLM analysis of transcripts (default) | Transcripts (with PII redaction applied) | US | EU-US DPF + SCCs fallback |
| 4 | Anthropic (via OpenRouter) | LLM analysis of transcripts — alternate provider, active only when a tenant selects it (default is OpenAI) | Transcripts (with PII redaction applied) | US | SCCs |
Transcripts are sent to the LLM provider directly for analysis. The default provider is OpenAI; a tenant may select Anthropic (Claude) as an alternate, in which case requests are routed through the OpenRouter gateway. PII redaction (phone numbers, emails, card numbers) is applied before any transcript is transmitted.
Authentication
| # | Provider | Purpose | Data Processed | Location | Transfer Mechanism |
|---|---|---|---|---|---|
| 5 | Clerk | User authentication and session management | User accounts (name, email), sessions, login events | US | EU-US DPF + SCCs fallback |
Data sensitivity: MEDIUM — No call content or transcripts. Only user account data.
Data Storage
| # | Provider | Purpose | Data Processed | Location | Transfer Mechanism |
|---|---|---|---|---|---|
| 6 | Neon | Primary database (PostgreSQL) | Transcripts, AI analyses, metadata, user data | US (configurable) | EU-US DPF + SCCs fallback |
| 7 | Cloudflare | Infrastructure: R2 (audio storage), D1 (edge metadata), Workers (compute) | Audio files (R2), metadata (D1), all data in transit | Global (edge) | Cloudflare DPA + SCCs |
Communications
| # | Provider | Purpose | Data Processed | Location | Transfer Mechanism |
|---|---|---|---|---|---|
| 8 | Resend | Transactional email delivery (notifications, alerts) | Email addresses, delivery metadata. No call content. | US | EU-US DPF + SCCs fallback |
| 9 | SendPulse | Onboarding email automation — active only for newly-registered account owners | Email address, onboarding metadata (name, locale, plan, signup source). No call content. | US | SCCs |
Data sensitivity: LOW — Only email addresses and onboarding metadata; no call content or transcripts.
Observability
| # | Provider | Purpose | Data Processed | Location | Transfer Mechanism |
|---|---|---|---|---|---|
| 10 | Langfuse | LLM observability (traces, cost tracking) — active only when observability is enabled | LLM traces, token counts, latency. No raw transcripts. | EU (Germany) | Not required (EU→EU) |
Data sensitivity: LOW — Operational traces only. No PII, no call content. Langfuse is an optional observability layer; when it is not enabled, no data is transmitted to it.
Summary
| # | Provider | Data Risk | Location |
|---|---|---|---|
| 1 | ElevenLabs | HIGH (audio) | US |
| 2 | Deepgram | HIGH (audio) | US |
| 3 | OpenAI | HIGH (transcripts) | US |
| 4 | Anthropic (via OpenRouter) | HIGH (transcripts) — alternate, opt-in | US |
| 5 | Clerk | MEDIUM (accounts) | US |
| 6 | Neon | HIGH (all data) | US |
| 7 | Cloudflare | HIGH (audio + metadata) | Global |
| 8 | Resend | LOW (metadata) | US |
| 9 | SendPulse | LOW (contact + onboarding metadata) | US |
| 10 | Langfuse | LOW (traces) | EU |
Not Sub-Processors
| Integration | Why Not a Sub-Processor |
|---|---|
| Bitrix24 | Customer's own CRM. Aelo sends data to Customer-configured webhook URL on Customer's instruction. Bitrix24 is the Customer's processor, not Aelo's sub-processor. |
| n8n | Self-hosted by tenant. Aelo sends webhook to tenant-provided URL. n8n processes data under tenant's control. |
Change Notification Policy
- New sub-processor: Customers notified via email at least 30 days before processing begins
- Objection right: Customers may object within the 30-day notice period
- Removal: If objection cannot be resolved, customer may terminate the affected service
- Updates: Published at this URL and in the Aelo documentation
Contact
For questions about sub-processors or data processing:
Auspex Streamline S.L.
C.I.F.: B56341829
Calle Velarde 13, 4B
35010 Las Palmas de Gran Canaria
Canarias, Spain
Email: privacy@auspex.company
Document ID: SPL-Aelo-2026-001 · Version: 1.5