Service providers (sub-processors)
Last updated: 25 September 2026
Data storage and our servers stay in the EU. AI inference runs on a mix of EU and US infrastructure: Deepgram’s speech services run in the EU, and the language models on Microsoft Azure run in the US by default and may be processed in other Azure regions. Some other providers are in the United States. Transfers outside the EU/EEA rely on the EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.
| Provider | Purpose | Data | Region | Transfer basis |
|---|---|---|---|---|
| Neon | Database | Everything we store | EU (Frankfurt) | Within EU/EEA |
| Fly.io | Application hosting | Service data in transit | EU (Frankfurt) | US entity, SCCs |
| Daily (including Pipecat Cloud) | Real-time call transport, and hosting of the live interview | Live call audio and the interview as it happens | Call rooms and call workers in the EU (Frankfurt) | US entity, SCCs |
| Deepgram | Speech to text and text to speech | Live call audio and Sasha’s spoken replies | EU region | US entity, SCCs |
| Cartesia | Text to speech, when selected | Sasha’s spoken replies | United States | SCCs |
| ElevenLabs | Speech, when selected | Live call audio and Sasha’s spoken replies | United States | SCCs |
| Microsoft Azure AI Foundry | Language models: interviewing, assessment, role drafting | Transcripts, role profiles, conversations with Sasha | Stored in Germany. Processed in the US by default, and may be processed in other Azure regions | SCCs in Microsoft’s Data Protection Addendum when outside the EU/EEA |
| OpenAI | Language models, when selected | Transcripts, role profiles, conversations with Sasha | United States | SCCs |
| Anthropic | Language models, when selected | Transcripts, role profiles, conversations with Sasha | United States | SCCs |
| Google Cloud (Vertex AI) | Language models, when selected | Transcripts, role profiles, conversations with Sasha | EU | SCCs |
| WorkOS | Recruiter sign-in | Recruiter email and identity | United States | SCCs / EU–US DPF |
| Resend | Invitation emails | Candidate name and email | United States | SCCs |
| PostHog | Product analytics | Candidate-journey events keyed to an opaque invitation id | EU | Within EU/EEA |
| Logfire (Pydantic) | Operational telemetry, content excluded | Operational metadata | EU | Within EU/EEA |
| Notion | CRM for demo requests and product feedback | Demo-lead contact and questionnaire, and candidate feedback about Sasha with no name or email | United States | SCCs |
Providers marked “when selected” process data only when that provider is configured for your organisation. Removed from the June list: Mistral and Cloudflare Turnstile, neither in use. Enterprise customers who require EU-only processing can get it by special arrangement, at extra cost and possibly without every feature.
Our AI model providers, Microsoft Azure and Deepgram, do not use your data for training. Call audio is never stored. We may add or replace providers; customers are told in advance and may object on reasonable grounds. Questions: privacy@sasharec.ai.