Service Providers and Subprocessors
Last updated: 22 September 2026
How to read this list
This page names the third-party services that may process personal data when Solas provides the features you choose. Not every provider receives every user's data: a provider is used only when the relevant feature, integration, or delivery route applies.
A processor handles personal data on instructions. An independent controller decides how to use information for its own legal, regulatory, security, payment, or platform purposes. Some providers perform both roles. See our Privacy Policy for our purposes, lawful bases, retention periods, transfer safeguards, and your rights.
Current providers
| Provider | Service and data | Processor or other role | Processing location |
|---|---|---|---|
| Supabase | Primary database, file storage, and legacy authentication during the identity transition. Account, business, customer, financial, communication, and stored-document data. | Processor | European Union, with the production project configured in Ireland. |
| Amazon Web Services (AWS) | Application hosting, networking, object storage, inbound email, operational logging, and Amazon Bedrock model hosting. Service data handled by the relevant workload, including call content, email, assistant context, identifiers, and operational logs. | Processor | Primarily UK and European regions; support and subprocessors may operate elsewhere. |
| Anthropic through Amazon Bedrock | Claude model inference for the Solas assistant. Assistant prompts, conversation context, tool inputs and results, supplied images, and generated responses. | Processor | The selected AWS Bedrock region and the processing described in the applicable AWS terms. |
| Auth0 by Okta | Hosted registration, sign-in, verification, recovery, and authentication security. Email address, external identity, credentials handled by Auth0, verification state, sessions, and authentication telemetry. | Processor | Tenant hosting locality plus global support, security, content-delivery, and subprocessor operations. |
| Google Cloud / Vertex AI | Receipt recognition, expense categorisation, and document-search embeddings. Receipt images, extracted receipt information, limited business context, and document-search content. | Processor | European Union for configured production model endpoints, subject to Google Cloud's applicable terms. |
| Twilio | Telephone-number provisioning, voice and SMS routing, and WhatsApp transport and sender administration. Telephone numbers, message content, call and message metadata, delivery status, and account or regulatory information. | Processor and independent controller | European Union, United States, and other locations depending on the product, support path, and subprocessor. |
| Meta / WhatsApp | WhatsApp Business account connection, messaging, templates, and delivery status. Business and contact identifiers, messages, attachments, templates, status information, and connection events. | Processor and independent controller | European Union, United States, and other locations described in the applicable WhatsApp Business terms. |
| ElevenLabs | AI telephone agent, live voice processing, transcription, recordings, and voice-agent tool use. Caller audio, telephone numbers, transcripts, call metadata, business instructions, and relevant customer or job context. | Processor | United States by default; other residency controls depend on the contracted plan and configuration. |
| OpenAI (through ElevenLabs) | The default Front Desk language model when no custom model is configured. Caller transcripts, business instructions, and relevant customer, enquiry, job, and tool context routed through the ElevenLabs integration. | Processor | OpenAI processing and retention depend on the ElevenLabs integration, applicable provider terms, and configured workspace; confirm the production path before enabling the feature. |
| Regulated Open Banking provider | Open Banking consent, account connection, and transaction synchronisation when the integration is enabled. Identity and consent records, bank-account details, balances, and transaction information. | Role depends on the service | To be confirmed from the production agreement before Open Banking is enabled. |
| PostHog | Product analytics, website diagnostics, and website session replay outside blocked authentication surfaces. Account-linked mobile usage events and website interaction, device, browser, approximate-location, replay, and error data. | Processor | European Union cloud project, with support and subprocessors governed by the applicable terms. |
| Brave Search | Web-search results requested through the Solas assistant. Generated search-query text, which may itself contain information from the user's request. | Role depends on the service | United States processing is described for Search API queries. |
| Resend | Transactional email delivery. Recipient addresses, message content, delivery events, and related identifiers. | Processor | United States and provider-subprocessor locations under the applicable safeguards. |
| Stripe | Invoice payment collection and connected payment-account onboarding. Payment amount, invoice reference, connected-account details, and payment status. Solas does not receive full card details. | Processor and independent controller | United Kingdom, European Union, United States, and other locations used for payment, fraud, and regulatory processing. |
| RevenueCat | App Store subscription validation and entitlement management. App user identifier, product and entitlement information, and subscription lifecycle events. | Processor | United States and provider-subprocessor locations under the applicable safeguards. |
| Apple | App Store purchases, push-notification delivery, speech recognition, and Maps address or location services. Purchase and subscription records, device tokens and minimal notification payloads, dictation audio and transcripts, address-search text and results, and location data when you use those iPhone features. | Processor and independent controller | Apple's global infrastructure under its applicable developer and customer terms. |
| HM Revenue & Customs (HMRC) | Tax account access and supported Making Tax Digital submissions when those features become available. Tax identifiers, filing information, financial summaries, mandated fraud-prevention headers, and submission outcomes. | Independent controller | United Kingdom government infrastructure. |
Changes to this list
We review this list before introducing a provider that will process customer data and update it when a provider, purpose, or material processing location changes. Where our agreement with a business requires advance notice of a new subprocessor, we will provide that notice and the opportunity to object described in that agreement.
Questions or objections can be sent to privacy@solas.services.