Sub-Processor List

VoiceCraft engages third-party sub-processors to provide the VoiceCraft service. Sub-processors process Customer Content only on VoiceCraft's documented instructions and are bound by written contracts containing data protection terms substantially similar to those in our Data Processing Addendum.

VoiceCraft does not, and contractually requires its AI sub-processors not to, use Customer Content to train, retrain, or fine-tune AI or machine-learning models.

This page lists every sub-processor we engage, what data they receive, and links to their privacy policies. VoiceCraft commits to providing at least 30 days advance notice of any new sub-processor or material change to an existing one. See Section 3 for the notification and objection process.

The table below reflects the current set of sub-processors as of the date at the top of this page, grouped by service category.

VoiceCraft will provide at least 30 days advance notice of new sub-processors via email to the organization owner of each customer account. To receive these notifications, ensure the owner email address on your account is current.

We also maintain the most recent version of this page as the canonical record of all active sub-processors. Removal of a sub-processor does not require advance notice, but this page will be updated promptly to reflect the change.

If you object to the addition of a new sub-processor, you may submit a written objection within 30 days of the notice to privacy@voicescraft.app. Non-objection within 30 days constitutes acceptance.

If we cannot accommodate your objection (for example, if the sub-processor is essential to the service), you may terminate the affected service in accordance with our Data Processing Addendum.

Before engaging a new sub-processor, VoiceCraft evaluates the following:

• Security posture: SOC 2 Type II report or equivalent independent attestation where available; published security documentation otherwise.
• Privacy commitments: Published privacy policy that clearly states the provider does not use customer data for model training or independent marketing without consent.
• Contractual terms: Data Processing Agreement (DPA) or equivalent that binds the provider to process data only on VoiceCraft's instructions, for documented purposes only.
• Data minimization: We confirm that only the minimum data necessary to perform the service function is transmitted to each provider.
• Sub-processor chain: We review whether the provider itself uses further sub-processors for the processing in question and whether those are disclosed.
• Geographic location: We document where data is processed and stored, and apply appropriate transfer mechanisms for data leaving the United States.

This vetting process is repeated on a periodic basis and whenever a sub-processor updates its terms, policies, or ownership.