Trust & compliance
Sub-processors
Last updated: 13 October 2026
SUUS IQ B.V. engages the sub-processors below to deliver the service. For each supplier you see what we use it for, which data it processes, where that data is, on what basis it may leave the EEA and how the data processing agreement is arranged. Parties we use for our own invoicing, or that are controllers in their own right, are listed in the privacy policy.
A signed copy of a data processing agreement, for example for an audit, is available on request via info@suusiq.com.
Hosting and infrastructure
Supabase
Supabase Pte. Ltd. (Singapore)
- Purpose
- Database, sign-in and file storage
- Data
- Accounts, CRM data, visit reports, notes, transcripts and voice recordings
- Location
- EU (Ireland, AWS eu-west-1)
- Transfers outside the EEA
- Standard contractual clauses (SCC), part of the DPA
- Active
- Always
- Data processing agreement
- Yes, part of the supplier's terms
- Certifications (checked 13 October 2026)
- ISO 27001, SOC 2 Type 2, HIPAA
Vercel
Vercel Inc. (VS)
- Purpose
- Hosting of the app and the API
- Data
- All traffic of the app, including CRM data while it is being processed, and technical logs
- Location
- Servers in the EU (Frankfurt); Vercel also processes in the US
- Transfers outside the EEA
- EU-US Data Privacy Framework and standard contractual clauses (SCC)
- Active
- Always
- Data processing agreement
- Yes, part of the supplier's terms
- Certifications (checked 13 October 2026)
- ISO 27001, SOC 2 Type 2, PCI DSS, TISAX, HIPAA
Upstash
Upstash, Inc. (VS)
- Purpose
- Temporary storage: cache, rate limiting and the state of ongoing conversations
- Data
- Short-lived conversation state and counters, separated per customer
- Location
- EU (Frankfurt, AWS eu-central-1)
- Transfers outside the EEA
- EU-US Data Privacy Framework, with standard contractual clauses (SCC) as fallback
- Active
- Always
- Data processing agreement
- Yes, part of the supplier's terms
- Certifications (checked 13 October 2026)
- SOC 2 (type niet vermeld), HIPAA
Trigger.dev
API Hero Ltd, handelend als Trigger.dev (VK)
- Purpose
- Background jobs: enrichment, summaries, synchronisation and daily overviews
- Data
- Job payloads containing CRM data, job results and logs
- Location
- Execution in the EU (Frankfurt); job data and logs in the US (AWS us-east-1)
- Transfers outside the EEA
- United Kingdom: adequacy decision of the European Commission; to the US via SCC with their sub-processors
- Active
- Always
- Data processing agreement
- Yes, part of the supplier's terms
- Certifications (checked 13 October 2026)
- SOC 2 Type 2, HIPAA
Sentry
Functional Software, Inc., handelend als Sentry (VS)
- Purpose
- Error reporting and performance monitoring
- Data
- Technical error reports with limited user context (including IP address and browser); no session replays
- Location
- EU (Germany); account and organisation data in the US
- Transfers outside the EEA
- EU-US Data Privacy Framework, with standard contractual clauses (SCC) as fallback
- Active
- Always
- Data processing agreement
- Yes, concluded on 2 October 2026
- Certifications (checked 13 October 2026)
- ISO 27001, SOC 2 Type 2, HIPAA
Resend
Plus Five Five, Inc., handelend als Resend (VS)
- Purpose
- Transactional email: invitations, notifications, daily overviews and contracts
- Data
- Email addresses, names and the content of the emails
- Location
- Sent from the EU (Ireland); stored in the US
- Transfers outside the EEA
- EU-US Data Privacy Framework and standard contractual clauses (SCC)
- Active
- Always
- Data processing agreement
- Yes, part of the supplier's terms
- Certifications (checked 13 October 2026)
- SOC 2 Type 2
Voice and AI
LiveKit Cloud
LiveKit Incorporated (VS)
- Purpose
- Audio connection for voice calls and hosting of the voice agent
- Data
- Call audio (real time), technical session data and logs of the voice agent
- Location
- Voice agent in the EU (Frankfurt); live audio via the nearest LiveKit server (in the EU for users in the Netherlands and Belgium); session data and logs in the US. LiveKit does not store call recordings or transcripts
- Transfers outside the EEA
- EU-US Data Privacy Framework, with standard contractual clauses (SCC) as fallback
- Active
- Only with voice
- Data processing agreement
- Yes, part of the supplier's terms
- Certifications (checked 13 October 2026)
- SOC 2 Type 2, HIPAA
Deepgram
Deepgram, Inc. (VS)
- Purpose
- Real-time speech recognition during voice calls
- Data
- Call audio and its transcripts; processed in memory only, nothing stored and not used for training (opt-out)
- Location
- EU (Deepgram's EU endpoint)
- Transfers outside the EEA
- Standard contractual clauses (SCC, module 3), part of the DPA
- Active
- Only with voice
- Data processing agreement
- Yes, concluded on 6 October 2026
- Certifications (checked 13 October 2026)
- SOC 2 Type 2, HIPAA
- Documentation
- Data processing agreement: signed copy on requestSub-processors of Deepgram
Speechmatics
Cantab Research Ltd, handelend als Speechmatics (VK)
- Purpose
- Speech recognition of company names during voice calls
- Data
- Short audio fragments in which a company name is spoken, and the transcript; nothing stored after the call and not used for training
- Location
- EU (EU1 endpoint, processing within the EEA)
- Transfers outside the EEA
- None: processing within the EEA; standard contractual clauses (SCC, module 3) in the DPA for any transfer
- Active
- Only with voice
- Data processing agreement
- Yes, concluded on 6 October 2026
- Certifications (checked 13 October 2026)
- ISO 27001, SOC 2 Type 2, HIPAA
OpenAI
OpenAI Ireland Ltd. (Ierland)
- Purpose
- AI processing: understanding, summarising and transcribing conversations, and assistant replies
- Data
- Transcripts, notes and the CRM context of a request. Via the API: not used for training. OpenAI keeps requests for up to 30 days for abuse detection and deletes them afterwards.
- Location
- US
- Transfers outside the EEA
- Standard contractual clauses (SCC), part of the DPA
- Active
- With AI and voice features
- Data processing agreement
- Yes, part of the supplier's terms
- Certifications (checked 13 October 2026)
- ISO 27001, SOC 2 Type 2, ISO 27017, ISO 27018, ISO 27701, ISO 42001
Cartesia
Cartesia AI, Inc. (VS)
- Purpose
- The voice of the voice agent (text to speech)
- Data
- The text SUUS speaks, including names of contacts and companies; not used for training (opt-out)
- Location
- US
- Transfers outside the EEA
- Standard contractual clauses (SCC, module 2), part of the DPA
- Active
- Only with voice
- Data processing agreement
- Yes, part of the supplier's terms
- Certifications (checked 13 October 2026)
- SOC 2 Type 2
Integrations and lead gen
Nylas
Nylas, Inc. (VS)
- Purpose
- Calendar integration with Google Workspace and Microsoft 365
- Data
- Calendar events and attendees; email only if the user switches on the mail integration
- Location
- United Kingdom (London)
- Transfers outside the EEA
- United Kingdom: adequacy decision of the European Commission; to the US via the EU-US Data Privacy Framework and SCC (module 3, in the DPA)
- Active
- Only when a user connects their calendar
- Data processing agreement
- Yes, concluded on 2 October 2026
- Certifications (checked 13 October 2026)
- ISO 27001, SOC 2 Type 2, ISO 27701, HIPAA, PCI DSS
- Documentation
- Data processing agreement: signed copy on requestSub-processors of NylasTrust center of Nylas
Meta (WhatsApp Business Platform)
WhatsApp Ireland Limited (Ierland)
- Purpose
- WhatsApp messages with leads and feedback on the outcome of lead requests
- Data
- Phone numbers and WhatsApp messages; for feedback only the request id, the outcome and a score
- Location
- EU (Ireland) and US
- Transfers outside the EEA
- WhatsApp Ireland processes in the EU; transfer to Meta Platforms, Inc. under the WhatsApp Business Data Transfer Addendum, part of the processing terms
- Active
- Only with lead gen
- Data processing agreement
- Yes, part of the supplier's terms
- Certifications (checked 13 October 2026)
- ISO 27001, SOC 2 Type 2
Apify
Apify Technologies s.r.o. (Tsjechië)
- Purpose
- Collecting signals from public sources, with scrapers the customer selects
- Data
- Search queries and the public web and social media data the selected scrapers retrieve; this may contain names and contact details
- Location
- US (Amazon Web Services and MongoDB Atlas)
- Transfers outside the EEA
- Standard contractual clauses (SCC), part of the DPA
- Active
- Only when a customer switches on signal sources
- Data processing agreement
- Yes, part of the supplier's terms
- Certifications (checked 13 October 2026)
- SOC 2 Type 2
Higgsfield
Higgsfield Inc. (VS)
- Purpose
- Creating ad images for lead gen campaigns
- Data
- Image prompts based on the customer's offering, without personal data, and the generated images
- Location
- US
- Transfers outside the EEA
- No transfer of personal data: the image prompts contain none
- Active
- Only with lead gen using ads
- Data processing agreement
- Not needed: er gaan geen persoonsgegevens naar Higgsfield
- Certifications (checked 13 October 2026)
- No certification on its own security page
- Documentation
- Terms of Higgsfield
Twilio
Twilio Ireland Limited (Ierland)
- Purpose
- Phone line of the voice assistant (inbound and outbound calls), SMS verification (sign-in codes), SMS to leads and WhatsApp reminders
- Data
- Audio of phone calls (relayed in real time), phone numbers, message content and verification codes
- Location
- US
- Transfers outside the EEA
- Binding corporate rules (BCR), EU-US Data Privacy Framework and SCC
- Active
- With voice, SMS verification and notifications
- Data processing agreement
- Yes, part of the supplier's terms
- Certifications (checked 13 October 2026)
- ISO 27001, SOC 2 Type 2, ISO 27017, ISO 27018, PCI DSS, HIPAA
Support
Google Workspace
Google Cloud EMEA Limited (Ierland)
- Purpose
- Business email and documents of SUUS IQ: support and contracts
- Data
- Emails from and about customers, contract copies and support questions
- Location
- Worldwide (Google's data centres)
- Transfers outside the EEA
- EU-US Data Privacy Framework and standard contractual clauses (SCC)
- Active
- When you contact SUUS IQ
- Data processing agreement
- Yes, concluded on 2 October 2026
- Certifications (checked 13 October 2026)
- ISO 27001, SOC 2 (type niet vermeld), ISO 27017, ISO 27018, ISO 27701
Anthropic
Anthropic Ireland, Limited (Ierland)
- Purpose
- AI assistance (Claude) for support and error analysis
- Data
- In case of an outage or support question: conversation reports, transcripts and CRM data of the customer concerned
- Location
- US
- Transfers outside the EEA
- Standard contractual clauses (SCC), part of the DPA
- Active
- Only for support and error analysis
- Data processing agreement
- Yes, concluded on 13 October 2026
- Certifications (checked 13 October 2026)
- ISO 27001, SOC 2 Type 2, ISO 42001, HIPAA
Changes and objections
When we add or replace a sub-processor, we inform customers at least 14 days in advance by email and on this page.
Within those 14 days customers can object, stating their reasons, via info@suusiq.com. We then look for a solution in good faith. If none is found before the effective date, the customer may terminate the agreement free of charge as of that date. That is what article 6 of the data processing agreement says.
The sub-processors our suppliers engage themselves are not covered by that period. The suppliers announce those under their own data processing agreement. Where their list is public, it is linked under Documentation for that supplier below.
Scope
Not every sub-processor is active for every customer. Some suppliers only process data when a feature is switched on, such as voice, the calendar connection, lead gen or company data enrichment. That is stated per supplier.
This page belongs with our data processing agreement and privacy documentation. See also the Privacy policy and the Data processing agreement.