Sub-Processors
Last updated: September 25, 2026
Corebee uses the third-party services listed below to provide our customer support platform. We require each sub-processor to commit to data protection terms equivalent to those we offer our customers, via a Data Processing Addendum executed before any processing begins.
For Data Processing Agreements with any of the above, see our Data Processing Addendum or contact privacy@corebee.ai.
Current sub-processors
| Sub-processor | Purpose | Region | Data categories | Transfer safeguard |
|---|---|---|---|---|
| Supabase | Primary database (Postgres), authentication, real-time, file storage | India (AWS ap-south-1, Mumbai) | All product data: accounts, conversations, messages, knowledge base | SCCs |
| Vercel | Application hosting, CDN, edge middleware | India (Mumbai, bom1) + global CDN edge | HTTP request logs, transient request and response data | SCCs |
| Upstash | Redis cache (rate limits, sessions) | United States (AWS us-east-1) | Rate-limit counters, session tokens | DPF + SCCs |
| Anthropic | AI model inference | United States | Customer messages (sanitised), knowledge base content, AI response candidates | DPF + SCCs |
| OpenAI | AI model inference (chat, summarization, routing) | United States | Customer messages (sanitised), knowledge base content | DPF + SCCs |
| Google LLC (Gemini) | AI model inference | United States | Conversation messages | DPF + SCCs |
| Telnyx | Phone numbers, voice calls and SMS delivery | United States | Phone numbers, call audio, message content, call and message metadata | SCCs |
| Fly.io | Hosting for the real-time voice servers | United States (Ashburn, Virginia) | Live call audio and transcripts in transit | SCCs |
| Deepgram | Speech-to-text for voice calls | United States | Call audio, transcripts | SCCs |
| Cartesia | Text-to-speech for voice calls | United States | AI reply text to be spoken | SCCs |
| Twilio | SMS and WhatsApp delivery | United States | Phone numbers, message content | DPF + SCCs |
| Meta Platforms (WhatsApp Business, Messenger, Instagram) | Message routing for organisations that connect these channels | United States + Ireland | Message content, phone numbers or account identifiers | DPF + SCCs |
| Resend | Transactional email send and inbound email receive | United States | Email content, recipient addresses, delivery metadata | DPF + SCCs |
| Inngest | Background-job orchestration for AI auto-reply and workflows | United States | Job event payloads (org id, conversation id, message references) | SCCs |
| Firebase (Google Cloud) | Push notifications | United States | Device tokens | DPF + SCCs |
| Polar (Polar Software AB) | Subscription billing | EU / United States | Billing email, payment metadata for Corebee customers only | SCCs |
| Stripe | Payment processing for Corebee subscriptions | United States + EU | Billing details (name, address, payment method) for Corebee customers only | DPF + SCCs |
| PostHog (EU Cloud) | Product analytics and session replay | European Union (Frankfurt) | Usage events, anonymised user identifiers, page views | SCCs |
| Sentry | Error tracking | United States | Error stack traces (PII scrubbed), user agent, request context | DPF + SCCs |
| Firecrawl (Mendable) | Crawling the website pages a customer imports into its knowledge base | United States | Public web page URLs and page content the customer chooses to import | SCCs |
| Jina AI | Reading the website pages a customer imports into its knowledge base | Vendor-managed (see its privacy policy) | Public web page URLs and page content the customer chooses to import | SCCs |
| Cloudflare | DNS, DDoS protection, edge caching, browser rendering for knowledge-base imports | Global edge | HTTP request metadata, knowledge base URLs | DPF + SCCs |
Notification of changes
We will notify all customers at least 30 days before adding a new sub-processor that processes customer personal data, by email to the primary account owner. If you have a legitimate objection (e.g., regulatory or competitive) you may terminate the affected service per the terms of our Data Processing Addendum.
How we use sub-processors
Each sub-processor is engaged for a specific operational purpose listed above. We do not sell customer data to any sub-processor; we engage them to act on our behalf under written processing terms. Where a sub-processor is located outside the EU/UK, transfers rely on the EU Standard Contractual Clauses (SCCs) and/or the UK International Data Transfer Addendum.
For questions about a specific sub-processor or about how to subscribe to change notifications, contact privacy@corebee.ai.