Sub-processors
Last updated: September 3, 2026
The third-party services ZeroACE engages to run the product, and what each one can see. We publish the list rather than hand it out on request, because the Data Processing Agreement gives you the right to object to a change before it takes effect.
A service is here when ZeroACE engages it and answers for it. The providers you connect yourself are not — section 3 says why.
1. Current sub-processors
| Service | Vendor | Data it can see |
|---|---|---|
| Application hosting, database, and queues | Railway Corp. | Everything the platform stores: accounts, catalog, orders, conversations |
| Voice infrastructure hosting | DigitalOcean, LLC | Call audio and call metadata, including recordings while they are held there |
| Voice carriage and SMS delivery | Twilio Inc. | Phone numbers, call audio in transit, message bodies, and the regulatory identity documents a business uploads where a country requires them before issuing a number |
| Assistant reasoning (large language model) | Google LLC — Vertex AI / Gemini | Conversation text, catalog and order context |
| Speech-to-text | Soniox, Inc. | Caller audio |
| Speech-to-text | Speechmatics Ltd. | Caller audio |
| Text-to-speech | ElevenLabs Inc. | The text the assistant is about to speak |
| Text-to-speech | Cartesia, Inc. | The text the assistant is about to speak |
| WhatsApp Business messaging | Meta Platforms Ireland Limited | WhatsApp message content and the sender's WhatsApp id |
| Transactional and order email | Resend, Inc. | Recipient addresses — merchants and their customers — and the contents of those messages |
| ZeroACE subscription and commission billing | Stripe, Inc. | Merchant billing details. Not your customers' payments — those run on your own account |
| Object storage (files and call recordings) | Cloudflare, Inc. — R2 | Files a business stores through the platform, and call recordings where recording is switched on |
| Bot protection on application forms | Cloudflare, Inc. — Turnstile | Visitor IP address and the challenge result |
Speech-to-text and text-to-speech each name two vendors because both are configured and either one can receive the data.
On location: ZeroACE is operated from the United States, and these services process data there and in the other countries where they operate — the Privacy Policy covers international transfers. Object storage is the one entry with no region to state at all: it uses automatic placement, so nothing is pinned, and we would rather write that down than imply a guarantee we do not have.
2. None of them train on your data
Customer Data is not used to train foundation models — ours or anyone else's — and the AI providers above are engaged and configured so that data sent through their APIs is not used to train their models. The commitment is ours and it is written down: it is in the Terms of Service and in the Data Processing Agreement, and it applies to every provider on this list.
3. What is deliberately not on this list
Connected Providers are not sub-processors. Your store platform, payment provider, carrier and accounting system are your own accounts: we exchange data with them using the credentials you connect, on your instructions, and your agreement with them governs how they handle it. Calling them sub-processors would move responsibility onto us in a way that reads generous and is inaccurate.
4. Changes and notice
The date at the top of this page changes whenever this list does. Under the Data Processing Agreement we give notice of an intended change to a sub-processor and allow a reasonable opportunity to object on reasonable data-protection grounds; this page is where the change is published.
5. Questions
Write to privacy@zeroace.ai with anything about this list, including an objection to a change.