Sub-processors
Last updated: October 5, 2026
Underheard is operated by SFF S26 AG, St. Gallen, Switzerland. When we process personal data for our customers (for example the people they invite to a voice or text interview, or the people their voice agents call), we use the service providers below. Each one is bound by written data protection terms that provide substantially the same protection as our data processing addendum, with the EU Standard Contractual Clauses and the Swiss addendum, or an adequacy decision or data privacy framework, where data leaves Switzerland or the EU.
Our own database, which holds all customer data at rest, is in the European Union (Ireland), and the application runs in the EU (Dublin). Live voice processing and language-model processing take place with providers in the United States, as listed below.
| Sub-processor | Function | Data involved | Location, safeguard |
|---|---|---|---|
| Supabase | Database, authentication, file storage and backups | All customer data at rest: respondents and contacts, transcripts, summaries, results, study and workflow configuration | EU, Ireland (AWS eu-west-1). Executed DPA, EU SCCs with Swiss addendum |
| Vercel | Application hosting, serverless functions, content delivery, operational logs | Data in transit through the application, request and security logs | Compute in the EU (Dublin); content delivery and support may run outside the EU, including the United States. DPA with SCCs and Swiss terms |
| ElevenLabs | Conduct of the voice conversation: speech to text, text to speech and the language model that runs the live conversation (Anthropic Claude or Google Gemini, operated by ElevenLabs) | Audio in flight, transcript and conversation context. Recordings are not stored | United States (EU-US and Swiss-US Data Privacy Framework). DPA with SCCs and Swiss terms |
| Anthropic | Language model for text interviews and for summaries, data extraction and classification after the interview | Transcripts, interview context, study configuration. No audio | United States, contracting entity Anthropic Ireland Limited. Commercial DPA with SCCs. Inputs and outputs are deleted within 30 days and are not used for model training |
| Twilio | Telephony and text messages (optional) | Phone numbers, call metadata, SMS content; audio in transit during the call | United States. DPA with EU SCCs and Swiss addendum |
| Nango | Connector for CRM synchronisation (optional) | Only the fields the customer elects to synchronise | United States. DPA with SCCs |
| Resend | Transactional email (account and notification mail) | Account holder name and email address | United States. DPA with SCCs |
Providers marked optional process data only when a customer enables the corresponding feature: phone calls or text messages for Twilio, a connected CRM for Nango. A browser-only interview program uses neither.
Not sub-processors
- When a customer sends WhatsApp messages through its own Meta WhatsApp Business account, Meta acts for that customer, not as our sub-processor.
- A customer's own CRM, recruitment, messaging or telephony service (for example Salesforce or HubSpot) is the customer's own system, governed by the customer's agreement with that provider.
- Interview pages load cookie-free, aggregate page analytics (Plausible, hosted in the EU) so we can see that pages load and work. It does not identify respondents and is used for our own operations only.
- Payment processing and website analytics that Underheard uses for its own business purposes are covered by our privacy policy, not by this list.
Changes
We inform customers by email at least 30 days before we add or replace a sub-processor, and update this page and its date.
Contact
Questions about this list or our data processing addendum go to support@underheard.ai. Privacy policy · Your interview and your data