Last updated: October 25, 2026
Annex 2: Subprocessors
| Subprocessor | What it does | Data it handles | Location |
|---|---|---|---|
| Amazon Web Services | File storage | Files and attachments, including any call recordings Leadelta stores | United States (Oregon) |
| Supabase | Database | Customer Data stored in the Service | United States (Oregon) |
| Vercel | Web application hosting | Data shown in or sent through the web app | United States |
| Fly.io | Background processing | Data handled by workflows, messages and AI tasks | United States |
| Upstash | Job queues | Job data, which can include Customer Data in transit | United States |
| Twilio | Phone numbers, text and picture messages | Phone numbers, message content, attachments | United States |
| Vapi, and the speech, voice and AI model providers it uses: Soniox and Deepgram (speech to text), Vapi (voice) and Anthropic (AI model) | AI voice calls, recording and transcription | Call audio, recordings, transcripts and caller phone numbers; Vapi keeps call recordings and call data for 14 days, then permanently deletes them | United States |
| OpenAI | AI text processing: summaries, scores, extraction, drafts | Transcripts, messages, case details. Its terms bar using this data to train or improve its models unless Leadelta agrees, and Leadelta does not. Abuse-monitoring logs are kept up to 30 days | United States |
| Postmark | Sending and receiving email | Email addresses, content, attachments | United States |
| Clerk | Sign-in for Authorized Users | Authorized Users' names and emails | United States |
| Stripe | Payments | Customer's billing details only; no Lead Data | United States |
Services Customer connects itself, such as Clio or a webhook address, are Customer's own vendors, not Leadelta's Subprocessors.