Subprocessors
These are the third parties that process personal data on our behalf, what each one receives, and where it processes it. We publish the full list rather than a summary, because a partial list is worse than none.
Last updated: 25 July 2026
Changes. We keep this page up to date as our providers change.
| Processor | Purpose | Data it receives | Processing location | Their certifications |
|---|---|---|---|---|
| Google Cloud | Application hosting (Cloud Run), PostgreSQL database (Cloud SQL), secret storage and database backups | All application data at rest | United States (Oregon, us-west1) | Not verified by us |
| Cloudflare | CDN, DNS, object storage (R2), bot protection | Request metadata, IP addresses, uploaded media | Global edge network; R2 object storage is distributed and may hold copies outside the United States | SOC 2 Type II |
| Stripe | Payment processing | Name, email, payment metadata | United States | PCI DSS Level 1, SOC 2 |
| Anthropic | AI coaching content and written deliverables | Message text, conversation history, profile details, sprint commitments, extracted document text | United States | SOC 2 Type II |
| OpenAI | AI coaching responses, text-to-speech, and speech-to-text transcription in standard voice mode | Message text, conversation history, profile details, leadership diagnostic scores, and your spoken audio in standard voice mode | United States | Not verified by us |
| ElevenLabs | AI voice generation during Voice Sessions, live voice calls, and the AI phone assistant on our business phone number | Coaching session text; for a live voice call, your voice audio and its transcript; for a call to our business phone number, the call audio and transcript | United States, EU or Singapore | SOC 2 Type 2, ISO 27001, ISO 27701, ISO 42001, HIPAA |
| Resend | Transactional email delivery | Recipient email addresses, message content | United States | SOC 2 Type II |
| Twilio | SMS and WhatsApp messaging, and telephony for the business phone number | Phone numbers, message content, call metadata | United States | ISO 27001, SOC 2 |
| Microsoft | Calendar and contact sync (Graph API) | Calendar and contact data | United States | ISO 27001, SOC 2 |
| Sentry | Application error monitoring | Error context (personal data scrubbed before storage) | United States | SOC 2 Type II |
| Website analytics and tag management | Pages visited, time on site, referral source, IP address | United States | SOC 2, ISO 27001 |
Do AI providers train on your content?
The honest answer differs by provider, so we set it out per provider rather than making one blanket claim. Where a vendor does not give us a commitment, we say so.
OpenAI and Anthropic
Under the API terms on which we use them, content we send is not used to train their models. These are the two commitments we hold in writing.
ElevenLabs
ElevenLabs handles voice and text data under its own privacy policy (elevenlabs.io/privacy-policy) and terms, which describe how it may use data, including to train its models, and the opt-out it offers. We have opted our workspace out of model training, and ElevenLabs has confirmed in writing that the opt-out covers all content types, including conversation audio and transcripts, submitted after it is switched on. Beyond that we rely on ElevenLabs' policy and terms, and we do not hold any further written no-training commitment from ElevenLabs. For text to speech we therefore send only the reply text needed to produce the audio. A live voice call is different: your voice itself is sent to and recorded by ElevenLabs, which we delete after a limited period, so this position applies to that audio too.
In every case we send only what is needed to produce the immediate response. Digital Twin training material, uploaded documents and assessment responses are never sent to a voice provider. Voice conversations involve your spoken audio in two ways: in standard voice mode your audio goes to our speech-recognition provider to be transcribed and the voice-generation provider receives text only; on a live voice call, and on a call to our business phone number, the audio itself is sent to and recorded by the live-voice provider. The table above shows which provider does what today.
Frequently asked questions
See also our Privacy Policy and our Trust Centre.