← Back to home

Sub-processors

Last updated: 2026-05-09

Voxly engages the third parties listed below to operate the platform and deliver our service. We sign data processing agreements with each and require them to provide the same level of data protection that we provide to you under our own DPA.

Customer-opt-in connectors (Jira, Slack, Zapier, and others added to the Connectors marketplace) are sub-processors only for workspaces that explicitly install them. If your workspace has not connected a given provider, no data flows to it.

We give 30 days' advance notice of any new sub-processor before they begin processing customer data. How to subscribe to change notices.

Infrastructure

VendorPurposeLocationTierAddedLinks
Vercel Inc.
Vercel
Application hosting, edge network, CDN, and serverless function execution.United States (multi-region)C0-C32026-03-17DPA · Privacy
Supabase Inc.
Supabase
Managed PostgreSQL database, authentication, storage, and Vault for encrypted secrets.United States (AWS, multi-region)C0-C42026-03-17DPA · Privacy

Observability

VendorPurposeLocationTierAddedLinks
Functional Software, Inc. (Sentry)
Sentry
Server- and client-side error tracking. PII is scrubbed before transmission via Sentry beforeSend hook.United States (AWS, GCP)C22026-03-17DPA · Privacy

Communications

VendorPurposeLocationTierAddedLinks
Resend, Inc.
Resend
Transactional email delivery (workspace invites, notifications, GDPR Art.17 erasure-verification emails).United States (AWS)C32026-03-17DPA · Privacy

Payments

VendorPurposeLocationTierAddedLinks
Stripe, Inc.
Stripe
Subscription billing. Voxly never sees raw card data — Stripe Checkout/Elements tokenises payment instruments before they reach our servers.United States; EU subsidiaries for EU customersC42026-03-17DPA · Privacy

AI services

VendorPurposeLocationTierAddedLinks
Anthropic, PBC
Anthropic
LLM-powered feedback summarisation and categorisation (Claude API). Voxly does not allow Anthropic to retain prompts for training (zero-retention enrolment).United States (AWS)C22026-04-15DPA · Privacy
OpenAI, L.L.C.
OpenAI
Embedding generation for semantic feedback search. API access only; prompts not retained for training under our zero-retention agreement.United StatesC22026-04-15DPA · Privacy

Customer-opt-in connectors

VendorPurposeLocationTierAddedLinks
Atlassian Pty Ltd / Atlassian, Inc.
Atlassian (Jira) · opt-in only
Customer-opt-in connector. When a workspace admin connects Jira, Voxly relays feedback content the admin chooses to push, plus OAuth tokens stored in Voxly Vault, to Atlassian. Voxly never accesses the customer's Jira data outside the explicit push action.United States (AWS), EuropeC22026-04-29DPA · Privacy
Slack Technologies, LLC
Slack · opt-in only
Customer-opt-in connector. When a workspace admin connects Slack, Voxly posts notifications to the channels the admin selects. OAuth tokens stored in Voxly Vault.United States (AWS)C22026-04-29DPA · Privacy
Zapier, Inc.
Zapier · opt-in only
Customer-opt-in connector. When a workspace admin enables Zapier, Voxly delivers trigger payloads (feedback events) to Zaps the admin configures. Authentication is via a Voxly-issued API key.United States (AWS)C22026-04-29DPA · Privacy
Discord Inc.
Discord · opt-in only
Customer-opt-in connector. When a workspace admin attaches a Discord webhook to an AlertConfig rule, Voxly POSTs notification payloads to the channel the webhook addresses. The webhook URL itself (which is the credential) is stored in Voxly Vault; Discord never receives Voxly credentials. No PortalUser PII is sent unless the workspace admin includes it in the alert template. For the webhook-outbound model, the workspace admin's acceptance of the Discord Developer Terms of Service is the operative agreement governing data handling.United States (GCP, multi-region)C22026-05-09DPA · Privacy

Total current sub-processors: 11.