Subprocessors
Last updated: October 1, 2026
This page lists the third parties that process Customer Content on behalf of Big Sister AI Company under the Data Processing Agreement. It has two parts. Part A lists subprocessors engaged under Big Sister AI's own accounts. Part B lists systems that belong to the Customer, which Big Sister AI accesses with credentials the Customer issues; those are the Customer's own processors, and the Customer holds the data-protection terms with them.
Big Sister AI does not train, fine-tune or develop its own artificial intelligence models. It uses third-party models as supplied, on terms under which inputs are not used for the vendor's model training.
Changes. Big Sister AI gives at least 15 days' notice by email to the workspace's primary contact before a new subprocessor in Part A processes Customer Content. Customers may object on reasonable data-protection grounds within that period, as set out in Section 6 of the DPA. To receive notices at a different address, email notices@big-sister.ai.
Part A: Subprocessors (engaged under Big Sister AI's accounts)
| Subprocessor | Location | Purpose | Customer Content it receives |
|---|---|---|---|
| Amazon Web Services, Inc. | United States (US East) | Hosting, storage, compute and encrypted backups, including the raw data layer. No replication outside the region. | All |
| Microsoft Corporation (Azure AI Foundry) | United States (East US) | Model inference for scoring and analysis. Transcripts and prompts are submitted to models deployed in Azure AI Foundry; all scoring models run here. Inputs are not used for vendor model training. | Transcripts, call metadata, prompts |
| Snowflake Inc. | United States | Analytics warehouse. Holds scores and derived data, which may include business contact details. | Scores and derived data |
| Langfuse GmbH | United States (hosted) | Model-call observability. Receives prompts and completions from scoring runs, which contain transcript content. | Transcript content in prompts and completions |
| Granola, Inc. | United States | Big Sister AI's own meeting notetaker for calls its personnel hold with Customers (onboarding, support). Does not process Customer's sales calls. | Recordings and notes of calls with Big Sister AI staff |
| Google LLC (Google Workspace) | United States | Big Sister AI's email, documents and file storage. Holds correspondence with Customers and any call evidence shared by email. | Incidental |
| Anthropic, PBC (Claude workspace) | United States | Internal tooling used by Big Sister AI personnel for engineering, support and analysis. May process Customer Personal Data incidentally. Commercial terms; inputs are not used for model training. Not used inside the Product for scoring. | Incidental |
| Mango Technologies, Inc. (ClickUp) | United States | Work management. Support and delivery records may contain Customer contact details. | Contact details, usage data |
| Nango, Inc. | United States | Credential broker. Holds the API keys and OAuth tokens that grant access to the Part B systems. Holds no Customer Content. | Credentials only |
| PostHog, Inc. | United States | Product usage analytics inside the Product. Person profiles are keyed on the email addresses of Customer's users. No call content. | Identifiers and usage events |
| Functional Software, Inc. (Sentry) | United States | Application error monitoring. Personal-data capture is disabled; events carry tenant identifiers only. | Telemetry only |
| Stripe, Inc. | United States | Payments, invoicing and the billing portal. | Billing contact, company name, card details (held by Stripe, never by Big Sister AI) |
Part B: Customer-controlled source systems (accessed under Customer-issued credentials)
The systems below are contracted by the Customer under its own subscription. Big Sister AI accesses them using credentials the Customer issues, stores those credentials in its managed secrets store, and stops using them when the Customer revokes them. They are listed so the data flow is complete; they are not Big Sister AI subprocessors.
| System | Location | Purpose | Basis of access |
|---|---|---|---|
| Fireflies.ai, Inc. | United States | Meeting recording and transcription. The Customer's workspace. | Team-admin API key issued by the Customer |
| Other notetakers the Customer connects (Granola, tl;dv, Fathom, Gong, Otter, Read.ai, Plaud) | Vendor-dependent | Meeting recording and transcription in the Customer's own account. | Workspace or admin API key issued by the Customer, or a push webhook the Customer configures |
| Ringostat | European Union / United States | Telephony call audio. The Customer's own PBX project. | Authentication key issued by the Customer |
| Pipedrive, Zoho CRM, HubSpot or Creatio, as applicable (Team and Custom plans) | United States / European Union | CRM records the Product reads for context and reporting. | OAuth authorized by the Customer through the credential broker in Part A |
Personnel locations
Customer Content is hosted in the United States. It may be accessed, for support and engineering, by Big Sister AI personnel located in the United States and Ukraine, under the confidentiality and access controls described in Annex 2 of the DPA.
Change log
| Version | Date | Change |
|---|---|---|
subprocessors-2026-10 | 2026-10-01 | First public list. Mirrors Annex 3 of the Data Processing Agreement. |