Skip to content
Log in (opens in a new tab) Start for free (opens in a new tab) Book a demo (opens in a new tab)

Sub-processors

Complete list of the third-party suppliers processing personal data on behalf of Stepcode SRL in providing the Supportfast.ai service, with details of purposes, data location and the legal bases for transfers outside the EU.

Version: 2.4 | Updated: 19/05/2026 | Contractual reference: DPA Section 8 and Annex A
Convenience translation. This document is an English translation of the Italian original. Pursuant to Section 24.7 of the General Terms of Service, translations are provided for convenience only and the Italian version prevails in the event of any conflict of interpretation.
Stepcode SRL uses selected third-party suppliers to provide the Supportfast.ai software and services. Each supplier is bound by agreements under Article 28 GDPR and selected on the basis of documented criteria of reliability, security and compliance. This page is updated whenever the list of sub-processors changes. It is the authoritative reference point provided for in our Data Processing Agreement, Section 8. Every substantial change (addition or replacement of a sub-processor) is notified to Customers with 30 days’ notice, during which the Customer may object on legitimate and documented grounds.

1.“Bring Your Own Key” mode for AI providers

The platform supports two modes of using artificial intelligence models. The distinction has significant legal consequences for the characterisation of AI providers as sub-processors.

Mode A: API key managed by Stepcode (default)

The Customer uses the AI models through API keys managed by Stepcode. In that case the AI providers are sub-processors of Stepcode within the meaning of Article 28 GDPR, bound by the relevant DPAs and by the prohibition on using data to train models.

Mode B: Bring Your Own Key (BYOK)

The Customer may configure its Chatbots with an API key held in its own name with an AI provider (e.g. the OpenAI key of its corporate account). In that case:
  • Conversational data passes directly from the Stepcode system to the AI provider using the Customer’s credentials.
  • The contractual relationship for that specific processing is directly between the Customer and the AI provider, not mediated by Stepcode.
  • Stepcode does not act as processor for the processing carried out by the AI provider in BYOK mode; the AI provider does not qualify as a sub-processor of Stepcode for that Customer.
  • The Customer must independently review the terms of service, privacy notice and DPA of the AI provider chosen.
  • The other components of the processing carried out by Stepcode (storage, logs, infrastructure) are unaffected, and Stepcode remains a processor in respect of them.

2.Core sub-processors

Suppliers essential to the basic operation of the service. They are active for every Customer, irrespective of the specific modules used.

Infrastructure and service data

Supplier Registered office Purpose Data location Transfer basis DPA
Hetzner Online GmbH Nuremberg, Germany Hosting of the main application infrastructure (servers, databases) Germany (EU) Intra-EU Link
Amazon Web Services EMEA SARL eu-central-1 Frankfurt Storage and CDN for cdn.supportfast.ai Germany (EU) Intra-EU Link
Cloudflare, Inc. San Francisco, USA CDN, Web Application Firewall, anti-DDoS, SSL USA / global PoP network SCC + DPF Link
PostHog Inc. San Francisco, USA, EU region pinning Product analytics on the public website and console (usage events) Frankfurt (EU) Intra-EU Link

Artificial intelligence models (Stepcode mode)

All the AI providers listed are used exclusively with configurations that exclude the use of transmitted data for model training purposes (by way of contractual or technical opt-out from the reuse of data for training). That undertaking is reflected in the respective contractual agreements and in our DPA, Section 7.
Supplier Registered office Purpose Data location Transfer basis DPA
OpenAI Ireland Limited Dublin, Ireland Language models (LLM), Stepcode mode Ireland + USA SCC Link
Deepgram, Inc. San Francisco, USA Speech-to-text, real-time audio transcription USA SCC Link
ElevenLabs Inc. New York, USA Text-to-speech, speech synthesis of the Chatbot’s responses USA DPF + SCC Link
Stepcode periodically evaluates the integration of further AI providers as alternatives selectable by the Customer in the console. Upon actual activation, each provider will be added to the table above with its effective date, and Customers will be sent the 30 days’ notice required by the DPA.

3.Optional sub-processors

Suppliers involved in the processing only if the Customer activates the corresponding channel or feature. If the Customer does not use WhatsApp, for example, Meta receives no data.

Messaging channels

Supplier Registered office Channel / Purpose Data location Transfer basis Terms
Meta Platforms Ireland Ltd. Dublin, Ireland + USA WhatsApp Business API, Instagram Direct, Facebook Messenger Ireland + USA SCC + DPF Link

Voice module, AI Switchboard

Voice architecture: LiveKit Cloud with EU region pinning. The Supportfast voice pipeline uses LiveKit Cloud, the managed service of LiveKit Inc., to orchestrate real-time calls over WebRTC and for integrated SIP telephony (inbound and outbound numbering). LiveKit Cloud is configured with region pinning to the EU region (Belgium): audio, session metadata and SIP routing of the Customer’s calls remain in LiveKit’s European datacentres for the entire duration of the call. By default LiveKit Cloud does not record or retain audio streams: packets pass through in real time and are not persisted. Any recordings, where enabled by the Customer in the console, are sent directly to Stepcode’s storage (Hetzner EU) and do not remain on LiveKit’s systems. The STT and TTS technologies are listed in the Artificial intelligence models table.
Supplier Registered office Role Data location Transfer basis Terms
LiveKit, Inc. San Francisco, USA, EU region pinning LiveKit Cloud: WebRTC orchestration, integrated SIP telephony, EU region EU (Belgium) DPF + SCC Link

4.Stepcode’s suppliers, internal business use

Suppliers used by Stepcode SRL for its own internal business operations. They do not process Customer Data (end users’ conversational data) but may process the B2B Customer’s contact and invoicing details. They are listed for transparency, although they do not strictly fall within the sub-processors under Article 28 relating to the processing of Customer Data.
Supplier Purpose Data location Transfer basis
Google Ireland Ltd. Google Workspace, business e-mail, internal drive, calendar Ireland + USA SCC + DPF
Stripe Payments Europe Ltd. Payment processing, subscription management, invoicing Ireland (EU), USA group SCC + DPF
Acumbamail S.L. Sending transactional and marketing e-mail Spain (EU) Intra-EU
Microsoft Ireland Operations Ltd. Microsoft Clarity (heatmaps, behaviour analysis) on the public website, independent controller Ireland + USA SCC + DPF
Accounting firm Tax management, accounting, invoicing, social security compliance Italy (EU) Intra-EU

Marketing tools on the public website

The tools listed below are installed on the public website supportfast.ai for marketing and web statistics purposes. Those suppliers process browsing data for their own purposes, as independent or joint controllers, and not as sub-processors of Stepcode. They are listed for full transparency. Details of the cookies used are in the Cookie Policy. PostHog is also used within the authenticated console, where it acts as a processor for Stepcode (see Section 2).
Supplier Purpose Location Transfer basis
Google Ireland Ltd. Google Analytics 4, Google Tag Manager, statistical analysis of the public website Ireland + USA SCC + DPF
Meta Platforms Ireland Ltd. Meta Pixel, advertising campaign measurement and retargeting Ireland + USA SCC + DPF
Calendly LLC Booking of demos and commercial meetings by leads USA SCC
Wistia, Inc. Hosting and player for videos embedded in the public website USA SCC

5.Independent verification of certifications

The EU-U.S. Data Privacy Framework certification status of United States suppliers can be verified independently on the official register maintained by the United States Department of Commerce. The register is updated in real time and also indicates any suspension or withdrawal of certification. Official DPF register: dataprivacyframework.gov

Glossary of transfer bases

  • Intra-EU: the processing takes place within the European Economic Area, with no need for a specific international transfer basis.
  • DPF (EU-U.S. Data Privacy Framework): European Commission adequacy decision of 10 July 2023 for certified US suppliers. It constitutes an independent legal basis for the transfer.
  • SCC (Standard Contractual Clauses): standard clauses adopted by Decision (EU) 2021/914, executed between Stepcode and the sub-processor, supplemented by additional technical measures on the basis of a Transfer Impact Assessment.
  • SCC + DPF: dual basis, meaning the supplier is DPF-certified but the SCC are also executed as a supplementary measure, to give Customers the strongest possible safeguard.

6.Notification of changes to the list

Every addition or replacement of a sub-processor is notified to Customers with at least 30 days’ notice, as provided in DPA Section 8.4. The methods of communication are cumulative: update of this page, notice in the console and e-mail to the registered contact. During the notice period, the Customer may object to the change on legitimate and documented grounds. In that case the Parties shall negotiate in good faith a solution; failing agreement, the Customer may terminate the Agreement without penalty (DPA Section 8.5). To receive e-mail notification of every change to the list, write to info@supportfast.ai stating the address at which to receive updates.

7.Change history

History of changes to the list of sub-processors. The most recent entries appear at the top. Dates refer to the date on which the change took effect.

Version 2.4

OpenAI, LLC replaced by OpenAI Ireland Limited as contracting entity; transfer basis updated to SCC. Microsoft Clarity removed from the console. Deepgram and ElevenLabs reclassified as AI model suppliers. List updated with this version.

Version 2.3

Added LiveKit, Inc. (voice orchestration), Deepgram, Inc. (speech-to-text), ElevenLabs Inc. (text-to-speech) for the AI Switchboard module. Added PostHog Inc. (product analytics, EU region). Added Acumbamail S.L. (transactional e-mail). List updated with this version.

Pre-2026, Version 1

Informal list consisting of OpenAI as the sole AI provider, Hetzner for hosting, Cloudflare for CDN/WAF, Stripe for payments, AWS S3 for the CDN, Meta for the messaging channels.

8.Sub-processor selection criteria

Every sub-processor is assessed and periodically reviewed against documented criteria that give priority to the security of Customers’ data and compliance with European legislation.
  • Preference for EU location: all other things being equal in technical quality and price, a supplier with servers in the EU is preferred.
  • DPF certification: for US suppliers, a supplier certified under the Data Privacy Framework is preferred.
  • Public DPA and Article 28 GDPR: the supplier must make available a DPA compliant with Article 28 GDPR, executed before processing begins.
  • Demonstrable security measures: ISO 27001 or SOC 2 certifications, or equivalent independent audits, are a preference criterion.
  • No AI training: for AI model providers, a contractual prohibition or explicit technical configuration preventing the use of transmitted data for training.
  • Financial and operational stability: preference for suppliers with a documented track record and technical support in English or a European language.
  • Reversibility: preference for suppliers that allow migration or export of data without lock-in.
The principal sub-processors are reviewed at least once a year and whenever relevant events occur (security incidents, loss of certification, substantial changes to terms of service).

9.Contacts and related documents

For any clarification, request for a copy of the DPAs executed with individual sub-processors, request for the SCC, objection to a change or report: Related documents: