Subprocessor List

About This List

As a data controller, OmniOps uses various third-party service providers (subprocessors) to deliver our services. This list is maintained in compliance with:

GDPR Article 28 (Processor obligations)
GDPR Article 46 (Data transfers outside the EU)
CCPA disclosure requirements

We will notify customers at least 30 days before adding new subprocessors or making changes to existing ones.

Change Notification

To receive notifications about subprocessor changes:

Email hello@getomniops.com to subscribe to notifications
Check this page regularly for updates
Review the "Last Updated" date above

Enterprise customers can object to new subprocessors within the notification period.

Current Subprocessors

AI features are not anonymized. When you use the AI assistant, the AI receptionist, or voice input, the customer records the assistant looks up are sent to the AI provider as they are stored — including names, phone numbers, email addresses, service addresses and free-text notes — and voice input is sent as recorded audio for transcription. We do not de-identify or tokenize this data before transmission. If your organization needs AI features disabled, contact us.

Subprocessor	Purpose	Data Processed	Location	Compliance
Vercel Inc. vercel.com	Application hosting and CDN	Application data, Usage logs	United States	SOC 2 Type IIEU-U.S. Data Privacy Framework
Supabase Inc. supabase.com	Database hosting and authentication	Customer data, User credentials, Business data	United States	SOC 2 Type II
Stripe, Inc. stripe.com	Payment processing	Payment information, Billing details	United States	PCI DSS Level 1SOC 2 Type II
Twilio Inc. twilio.com	SMS messaging	Phone numbers, Message content	United States	SOC 2 Type IIISO 27001
Resend resend.com	Transactional email delivery	Email addresses, Email content	United States	SOC 2 Type II
OpenAI, L.L.C. openai.com	AI assistant, AI-powered features, and voice transcription	Customer names, phone numbers, email addresses and service addresses, Job, quote, invoice and message content, Recorded voice input (audio) for transcription	United States	SOC 2 Type II
Anthropic PBC anthropic.com	AI assistant and AI-powered features	Customer names, phone numbers, email addresses and service addresses, Job, quote, invoice and message content	United States	SOC 2 Type II
Google LLC google.com	Maps, geocoding, and analytics	Location data, Usage analytics	United States / Global	ISO 27001SOC 2/3
Sentry sentry.io	Error monitoring and performance tracking	Error logs, Performance metrics	United States	SOC 2 Type IIEU-U.S. Data Privacy Framework
Upstash upstash.com	Rate limiting and caching	Request metadata, Cache data	United States	SOC 2 Type II

Data Transfer Safeguards

For subprocessors located outside the European Economic Area (EEA), we use the following safeguards:

Standard Contractual Clauses (SCCs): EU Commission-approved contracts for international data transfers
Adequacy Decisions: Countries recognized by the EU as having adequate data protection (e.g., EU-US Data Privacy Framework participants)
Additional Safeguards: Encryption, access controls, and security certifications

Due Diligence

Before engaging any subprocessor, we:

Conduct security and privacy assessments
Verify compliance certifications
Execute Data Processing Agreements (DPAs)
Review their data breach notification procedures
Assess their technical and organizational security measures
Conduct ongoing monitoring and audits

Your Rights

As an OmniOps customer, you have the right to:

Receive 30 days' notice before we add or replace subprocessors
Object to the use of a specific subprocessor (enterprise customers)
Request information about our subprocessors' security practices
Receive copies of relevant DPAs (enterprise customers)

Contact Us

For questions about our subprocessors or to exercise your rights:

Email: hello@getomniops.com