Sub-processors — A1 Voice

Extracted from Schedule 3 of the A1 Voice Data Processing Agreement. For the full DPA see /dpa.

Schedule 3 — List of Approved Sub-processors

The Sub-processors listed below are authorised at the date of this DPA. Each one processes Customer Personal Data on behalf of the Processor under a written contract imposing data-protection obligations no less protective than this DPA. Updates are made under clause 4.4.

Sub-processor	Purpose	Region of processing
Amazon Web Services (AWS)	Hosting, compute, storage, networking — including the call-handling pipeline (WebRTC, audio storage, transcripts, dashboard, database)	UK (`eu-west-2`, London) — all infrastructure pinned to AWS's London region
Google (Gemini API via Vertex AI)	Large-language-model inference for call handling	UK (`europe-west2`, London) — region-pinned via the Vertex AI EU regional endpoint (`europe-west2-aiplatform.googleapis.com`); auth via service-account ADC. `europe-west2` is Google Cloud's London region — a UK locality, included in Vertex AI's "EU" product offering. Live on both staging and production since 2026-05-11 (PR #30 + PR #36). Where a fail-over outside the UK / EEA is exceptionally required, UK IDTA / SCCs apply.
OpenRouter (where configured)	Alternative LLM routing for some agent roles	Not currently configured in the production profile; this row is retained for transparency in case it is re-enabled. If re-enabled, OpenRouter would route to the underlying provider it judges best (no region pin); UK IDTA / SCCs would apply, and the Processor would re-notify Controllers per clause 4.4.4.

Notes:

This Schedule lists only the third parties that process Customer Personal Data on the Processor's behalf. Other third-party services that the Processor uses but that do not process Customer Personal Data (Cal.com EU for demo booking on the Processor's marketing pages; Stripe for the Processor's own customer billing; Caddy / Let's Encrypt for TLS; GitHub for source-control) are listed for transparency in Schedule 4 and are not Sub-processors for the purposes of this DPA.
The Processor's companion Privacy Policy (https://voice.a1ergo.tech/privacy § 4) lists the same Sub-processors. Schedule 3 and the Privacy Policy stay in lock-step — when one moves, the other moves.