Sub-processor Registry
Last updated: October 22, 2026
Under Article 28 of the EU General Data Protection Regulation (GDPR), PersonaliAI maintains an up-to-date registry of third-party sub-processors authorized to process personal data on behalf of Chatty customers.
Authorized Third-Party Sub-processors
All sub-processors undergo stringent technical and security assessments. We require every sub-processor to maintain enterprise-grade security standards, encrypt data at rest and in transit, and execute appropriate data transfer mechanisms including the European Commission’s Standard Contractual Clauses (SCCs) or certification under the EU-U.S. Data Privacy Framework (DPF).
| Sub-processor | Processing Purpose | Hosting Country | Transfer Safeguard | Certifications |
|---|---|---|---|---|
| Supabase Inc. | Primary PostgreSQL database hosting, row-level access control, vector search embeddings, and file storage. | United States / AWS Multi-Region (AP / EU / US) | EU Standard Contractual Clauses (SCCs) | SOC 2 Type II, ISO 27001 |
| Google Cloud Platform & Vertex AI | Large language model inference (Gemini 2.5 Flash / Vertex AI) under strict zero-training enterprise data agreements. | European Union / United States | EU-U.S. Data Privacy Framework (DPF) & SCCs | ISO 27001, SOC 2/3, FedRAMP High |
| Meta Platforms Ireland Ltd. | Delivery and reception of WhatsApp Business messages, Instagram DMs, and Facebook Messenger webhooks. | European Union (Ireland) / United States | Meta EU Data Processing Terms & SCCs | ISO 27001, SOC 2 |
| Twilio Inc. | Delivery and inbound reception of Two-Way SMS messages and customer support notifications. | United States | Binding Corporate Rules (BCRs) & EU SCCs | ISO 27001, SOC 2 Type II |
| Resend Inc. | Transactional email delivery, booking confirmation receipts, and two-way email support forwarding. | United States | Data Processing Agreement with EU SCCs | SOC 2 Type II |
| Lemon Squeezy LLC & Stripe Inc. | Merchant of Record, billing orchestration, payment processing, and VAT/sales tax compliance. | United States / United Kingdom | EU-U.S. Data Privacy Framework (DPF) & SCCs | PCI-DSS Level 1, SOC 1 & 2 |
| Sentry (Functional Software Inc.) | Application crash reporting and error diagnostics with automated PII scrubbing. | United States | EU-U.S. Data Privacy Framework (DPF) & SCCs | SOC 2 Type II, ISO 27001 |
Zero AI Model Training Commitment
PersonaliAI strictly mandates that third-party AI model providers (including Google Cloud / Vertex AI and OpenAI) do not use customer prompts, knowledge documents, or conversational data to train, retrain, or fine-tune public foundation models. Customer data is processed solely in transient memory to generate real-time responses.
Sub-processor Change Notifications
Chatty notifies workspace owners at least 30 days prior to authorizing any new sub-processor that will have access to customer personal data. Customers may object to any newly proposed sub-processor on reasonable data protection grounds by emailing privacy@personaliai.com.
Questions & Legal Inquiries
For inquiries regarding our sub-processor security evaluations or data protection agreements, contact privacy@personaliai.com.