Security Measures
and Sub-Processors

Technical and organisational
measures to ensure the
security of Personal Data

Technical measures

• Our infrastructure runs on Google Cloud Platform (GCP) in UK and EU regions. Real-time voice, telephony and language-model processing takes place in the US with the sub-processors listed in Annex 2.

• MongoDB (UK region) is our primary database. Data is encrypted at rest with AES-256 and encrypted in transit (TLS).

• We maintain periodic automated backups of all production databases with secure storage and controlled access.

• Access to infrastructure is restricted via IAM, MFA-enforced accounts and least-privilege roles.

• Monitoring, alerting and log management are handled by Datadog, configured within EU regions.

• We use Vanta to continuously monitor our security position and maintain compliance with ISO27001:2022 and SOC2 frameworks.

• All software is kept up-to-date and security updates are installed as soon as reasonably possible.

Organisational measures

• Operational practices include regular patching, vulnerability scanning, penetration testing and maintaining incident management and response processes.

• Making all employees and third-party agents fully aware of their individual responsibilities under the UK GDPR.

Current sub-processors

Sub-processor change notification terms

We give customers 30 days' advance notice of a new or changed sub-processor, and 48 hours for an urgent replacement (e.g. a security issue).

OpenAI: foundational model provider

US

SCCs + UK Addendum; TRA completed

1.0

25 March 2026

Security Measures and Sub-Processors

James Wilson

Rameen Sorkhabi

1.1

25 June 2026

Updated sub-processor list and transfer mechanisms.

Freddie Poser

Freddie Poser

1.2

28 July 2026

Reconciled to internal register: removed Qdrant and LangSmith (decommissioned); moved OpenAI and Gemini to retained (not in live production); added Pylon, Vercel and Slack; GCP US-access leg annotated.

James Wilson

Freddie Poser

1.3

28 September 2026

Reconciled to internal register v1.8: removed Redis Cloud (decommissioned), SendGrid (no longer used) and Google Gemini (not called directly); ElevenLabs, Twilio, MongoDB Atlas, Nylas and Vercel entries corrected.

Gabriele Martoglia

James Wilson

1.4

2 October 2026

Vercel entry generalised

Gabriele Martoglia

James Wilson

1.5

5 October 2026

Annex 1 hosting and network statements corrected; Twilio transfer mechanism aligned to register.

Gabriele Martoglia

James Wilson