Legal
Sub-processors
Built in Europe. Your data stays here. All persistent customer data — your business profile, your calendar bookings, call transcripts, the evidence log — is hosted in the EU (Frankfurt). Voice and AI processing for speech recognition, speech synthesis and language AI currently transits SCC-protected US endpoints (Retell, ElevenLabs, Anthropic). EU endpoint migration is on the roadmap. To make Tirza work we rely on a number of specialised partners; below you can see exactly who does what, in which country, and on which legal basis. We notify our business customers of changes to this list 30 days in advance by email.
Last updated: 2 May 2026 · Version 1.1
Core data within EU
Yes
Database + analytics + hosting
US partners under SCCs
3 of 10
Retell · ElevenLabs · Anthropic — full list below
TIA performed
Annually
Review at legal change
In summary
Your core data (account, transcripts, evidence log) is hosted in Frankfurt. For voice AI we use three US partners — for those we have Standard Contractual Clauses and a per-provider Transfer Impact Assessment. Audio is deleted automatically after 30 or 90 days.
Retell AI
United States (Delaware)
- Processing location
- US + EU (AWS regions)
- Role
- Telephony, speech recognition (STT), speech synthesis (TTS)
- Data category
- Audio, transcripts, phone numbers
- Legal basis
- SCCs (Module 2) + Transfer Impact Assessment
ElevenLabs
United States (New York)
- Processing location
- US
- Role
- Voice cloning and speech synthesis for custom voices
- Data category
- Audio (voice training, only with consent)
- Legal basis
- SCCs (Module 2) + TIA
Anthropic
United States (San Francisco)
- Processing location
- US (EU endpoint available)
- Role
- Language AI (Claude Haiku) for wizard guidance and tone normalisation
- Data category
- Text instructions and replies (PII scrubbed beforehand)
- Legal basis
- SCCs (Module 2) + TIA
Supabase
United States (parent company)
- Processing location
- Frankfurt, Germany (EU)
- Role
- Database, authentication and storage of customer and call data
- Data category
- Customer data, transcripts, metadata, evidence log
- Legal basis
- No transfer outside the EU
Vercel
United States (parent company)
- Processing location
- EU edge (Frankfurt, Amsterdam)
- Role
- Hosting of the website and server functions
- Data category
- Static assets, temporary request data
- Legal basis
- EU region explicitly selected
Stripe Payments Europe
Ireland (EU)
- Processing location
- Dublin (EU) for EU customers
- Role
- Payments, subscription management, invoicing
- Data category
- Payment details, invoices (we never see card numbers)
- Legal basis
- EU entity, no transfer outside the EU
PostHog
United Kingdom (parent company)
- Processing location
- Frankfurt, Germany (eu.posthog.com)
- Role
- Product analytics — understanding how to improve the dashboard
- Data category
- Pseudonymised usage data (PII removed)
- Legal basis
- EU cloud explicitly selected
Sentry
United States (parent company)
- Processing location
- EU region (Frankfurt)
- Role
- Error tracking and performance monitoring
- Data category
- Stack traces (PII actively scrubbed prior to transmission)
- Legal basis
- EU region explicitly selected
United States
- Processing location
- US + EU (distributed)
- Role
- Google Calendar integration for appointment booking
- Data category
- OAuth tokens, calendar events
- Legal basis
- EU-US Data Privacy Framework (adequacy decision)
Twilio Ireland
Ireland (EU)
- Processing location
- Dublin (EU) for EU customers
- Role
- Sending SMS confirmations
- Data category
- Phone numbers, SMS content
- Legal basis
- EU entity, no transfer outside the EU
Right to object (B2B customers)
Business customers with a data processing agreement with us can object to the addition of a new sub-processor within 30 days of notification. If you object, we first try to find an alternative; if that is not possible, you may cancel free of charge with effect from the date the change takes effect.
Send an objection to privacy@tirza.ai.
Subscribe to changes
Want to receive an email automatically when we update this list? Subscribe via privacy@tirza.ai with the subject "Subprocessors-updates".