Subprocessors
Last updated September 17, 2026
Every company your Sup AI employee’s work passes through, what reaches it, how long it keeps it, and where our own agreement with it stands. The same list is in your account under Account, Data.
OpenAI
What your employee reads and writes while it thinks, and the sound of its calls while it speaks.
Business associate agreement with zero data retention: being signed.
Keeps: Nothing once zero data retention is in force; up to 30 days for abuse monitoring until then. Never used for training.
Twilio
Calls, call recordings, and text messages, as your phone carrier.
Business associate agreement: being signed.
Keeps: A recording until our copy of it is kept, within minutes, when Twilio’s is deleted; its own call and message logs per its retention policy.
Supabase
Your employee’s whole record: transcripts, notes, recordings, screenshots, and files, encrypted at rest.
Business associate agreement (HIPAA add-on): being signed.
Keeps: As long as you keep it; backups for 7 days after something is deleted.
Vercel
The pages you look at and the steps of your employee’s work as they run.
Business associate agreement: being signed.
Keeps: Logs for up to 30 days; the state of a piece of work until it finishes.
Daytona
Your employee’s computer: its browser, its sign-ins, and whatever is on its screen.
Data processing terms with encryption at rest and deletion on delete: being signed.
Keeps: Until the computer is deleted, which is when you let the employee go.
Exa
Web searches. At a business that handles protected information, a search that carries a person (a name off your cards, a phone number, a birthday, a member number) is refused in code before it is sent.
No agreement is needed: nothing the law protects reaches it.
Keeps: Search queries, per its own policy.
The systems you sign your employee in to
Your practice or case system, your Slack, a mailbox you give it: whatever your employee does there is held by that company, as it is when a person on your staff does it.
No agreement is needed: nothing the law protects reaches it.
Keeps: As your own agreement with each of them says. They are your vendors, not ours.
Stripe
Your card and your invoices. Nothing about your customers.
No agreement is needed: nothing the law protects reaches it.
Keeps: As the card networks and tax law require.
Questions
Email support@sup.ai.