Telbox Sub-processors
Last updated: July 9, 2026
Telbox uses a small number of third-party service providers ("sub-processors") to run the service. Each is engaged under a data-processing agreement (DPA) or equivalent contractual terms. We update this list with at least 30 days' notice before adding or changing a sub-processor that processes personal data; to be notified, email privacy@telbox.ai with the subject "sub-processor notice".
This page names sub-processors on purpose — that is what a sub-processor disclosure is for, and it is required by GDPR Art. 28 and equivalent laws. The provider-anonymity rule in our marketing guardrails governs marketing copy only, not this legal disclosure.
AI processing
| Sub-processor |
Location |
Purpose |
Contractual basis |
| Google LLC (AI API, paid service) |
United States |
Transcription, summarisation, and language understanding of message and voice-note content when AI is enabled — content is decrypted server-side for processing and not used to train models under the paid-service terms |
Provider's commercial API terms for paid services (no-training) |
| On-premises embedding model (self-hosted) |
Telbox-operated infrastructure |
Generating vector embeddings for AI memory/search; runs on Telbox-controlled compute, content not sent to a third party for this step |
Operated by Telbox (not a third-party sub-processor); listed for transparency |
Infrastructure & hosting
| Sub-processor |
Location |
Purpose |
Contractual basis |
| Google Cloud EMEA Ltd. / Google Cloud |
Ireland / United States (us-central1) |
Application hosting (Cloud Run), database (Cloud SQL Postgres), cache (Memorystore Redis), object storage (Google Cloud Storage) for encrypted blobs and rows |
Google Cloud DPA |
| Cloudflare, Inc. |
United States (global edge) |
DNS, CDN, static-site hosting (Cloudflare Pages), and edge protection for telbox.ai and api.telbox.ai |
Cloudflare DPA |
Messaging, push & communications
| Sub-processor |
Location |
Purpose |
Contractual basis |
| Apple Inc. |
United States |
iOS push notifications (APNs / PushKit). Push payloads carry only a generic placeholder or an AI-derived summary — never raw ciphertext or plaintext message content |
Apple standard service agreement |
| Google LLC (Firebase Cloud Messaging) |
United States |
Android push notifications. Same content-minimisation as APNs |
Google/Firebase DPA |
| Twilio Inc. |
United States |
Phone-number verification (one-time passcodes via Twilio Verify) at sign-in / sign-up |
Twilio DPA |
Billing
| Sub-processor |
Location |
Purpose |
Contractual basis |
| Stripe, Inc. |
United States |
Payment processing for off-App-Store / off-Play billing (e.g. Business and Private-Server plans). Apple App Store and Google Play handle in-app purchase billing directly under their own terms |
Stripe DPA |
Diagnostics
| Sub-processor |
Location |
Purpose |
Contractual basis |
| Functional Software, Inc. (Sentry) |
United States |
Crash and error diagnostics, with personal data scrubbed and message content excluded |
Sentry DPA |
Notes
- Content-minimisation for push: notification payloads default to content-free (a generic "New message" / voice-note placeholder). Message content stays in the end-to-end-encrypted payload and is rendered on-device; it is only shown in a notification if you have explicitly opted in to content-in-notifications.
- Regional processing: production runs in Google Cloud
us-central1 (Iowa, USA). International transfers are covered in Privacy Policy §5.
- Changes: questions or objections to a listed sub-processor → privacy@telbox.ai.
