AI Voice Agentby Hisenbug
Sign In

Subprocessor Disclosure & Production Vendor Exhibit

PRE-RELEASE DRAFT FOR LEGAL REVIEW
This document sets forth the production subprocessor exhibit and third-party vendor disclosure for the Hisenbug voice platform prepared for the commercial pilot release. Subject to qualified legal counsel review.

Effective Date: [To be confirmed upon publication]
Last Updated: September 15, 2026
Operator: [Hisenbug Legal Entity — to be confirmed] ("Hisenbug")
Contact: hello@hisenbug.com

1. Overview & Policy

Hisenbug engages third-party service providers ("Subprocessors") to deliver specialized cloud hosting, telephony gateway, database storage, and artificial intelligence capabilities. In accordance with our Terms of Service and Data Processing Addendum (DPA), this document provides an authoritative, transparent disclosure of our production Subprocessor ecosystem.

Subprocessor Notice & Objection Framework

  • Advance Notice: Hisenbug will provide Customers with at least thirty (30) days' advance written notice of any intended material addition, replacement, or change to this Subprocessor list.
  • Notification Methods: Notice will be delivered via email to the Customer's primary administrative account contact or displayed as an authenticated announcement within the customer dashboard.
  • Customer Objections: Customers subject to Applicable Data Protection Law may submit reasonable written objections on legitimate data protection grounds within the 30-day notice period by contacting hello@hisenbug.com.

2. Production Subprocessor Exhibit

The table below outlines the third-party providers involved in the provision of the Services, explicitly distinguishing between Direct Infrastructure Providers contracted directly by Hisenbug and Indirect Downstream Providers engaged through our primary voice orchestration provider:

┌─────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
│                                           PRODUCTION SUBPROCESSOR EXHIBIT                                       │
├───────────────────────┬───────────────────────────────┬───────────────────────────────┬─────────────────────────┤
│ PROVIDER / ENTITY     │ PROCESSING ACTIVITY & ROLE    │ DATA CATEGORIES EXPOSED       │ PROCESSING LOCATION     │
├───────────────────────┴───────────────────────────────┴───────────────────────────────┴─────────────────────────┤
│ A. DIRECT HISENBUG INFRASTRUCTURE & SERVICE PROVIDERS (DIRECT CONTRACTUAL RELATIONSHIP)                         │
├───────────────────────┬───────────────────────────────┬───────────────────────────────┬─────────────────────────┤
│ Vapi                  │ Primary voice & telephony     │ Inbound caller phone number,  │ United States           │
│                       │ orchestration platform        │ raw audio stream, dialogue    │                         │
├───────────────────────┼───────────────────────────────┼───────────────────────────────┼─────────────────────────┤
│ Supabase              │ Managed PostgreSQL relational │ CRM lead records, call logs,  │ United States           │
│                       │ database & user authentication│ transcripts, broker settings  │ (AWS us-east-1)*        │
├───────────────────────┼───────────────────────────────┼───────────────────────────────┼─────────────────────────┤
│ Vercel                │ Web application hosting, CDN, │ HTTP request headers, client  │ Global Edge Network /   │
│                       │ and portal edge execution     │ IP address, session cookies   │ United States           │
├───────────────────────┼───────────────────────────────┼───────────────────────────────┼─────────────────────────┤
│ Oracle Cloud (OCI)    │ Virtual Private Server compute│ Tool server execution payloads│ Jeddah, Saudi Arabia    │
│                       │ host (agent.hisenbug.com)     │ and internal loopback traffic │ (OCI Cloud Region)      │
├───────────────────────┼───────────────────────────────┼───────────────────────────────┼─────────────────────────┤
│ Groq                  │ Fast LPU inference for post-  │ Verbatim call transcripts and │ United States           │
│                       │ call QA scoring & extraction  │ dialogue turns                │                         │
├───────────────────────┼───────────────────────────────┼───────────────────────────────┼─────────────────────────┤
│ Jina AI / Elastic     │ Text vector embeddings for    │ Property listing titles and   │ United States /         │
│                       │ real estate semantic search   │ descriptions (Zero caller PII)│ European Union          │
├───────────────────────┴───────────────────────────────┴───────────────────────────────┴─────────────────────────┤
│ B. INDIRECT DOWNSTREAM PROVIDERS ENGAGED THROUGH VAPI (NO DIRECT HISENBUG CONTRACT)                             │
├───────────────────────┬───────────────────────────────┬───────────────────────────────┬─────────────────────────┤
│ OpenAI                │ In-call conversational LLM    │ Transcribed dialogue turns,   │ Vendor-dependent; see   │
│                       │ dialogue reasoning (GPT-4o)   │ system prompts, context       │ Vapi terms & routing**  │
├───────────────────────┼───────────────────────────────┼───────────────────────────────┼─────────────────────────┤
│ Deepgram              │ Real-time Speech-to-Text (STT)│ Inbound raw audio stream      │ Vendor-dependent; see   │
│                       │ transcription (Nova-3)        │ (processed in memory)         │ Vapi terms & routing**  │
├───────────────────────┼───────────────────────────────┼───────────────────────────────┼─────────────────────────┤
│ ElevenLabs            │ Real-time Text-to-Speech (TTS)│ Synthesized agent dialogue    │ Vendor-dependent; see   │
│                       │ voice generation              │ text turns                    │ Vapi terms & routing**  │
├───────────────────────┼───────────────────────────────┼───────────────────────────────┼─────────────────────────┤
│ Vapi Downstream       │ Upstream carrier trunking,    │ Telephony signaling metadata, │ Vendor-dependent; see   │
│ Infrastructure        │ call termination, and media   │ caller ANI/DNIS, raw audio    │ Vapi terms & routing**  │
│ Providers             │ streaming infrastructure      │ transport bytes               │                         │
└───────────────────────┴───────────────────────────────┴───────────────────────────────┴─────────────────────────┘

*Note on Database Location: The production database project is configured in the United States (AWS us-east-1); additional processing or infrastructure locations may be governed by Supabase's applicable service architecture and contractual documentation.

**Note on Downstream Locations: Specific downstream providers and processing locations may depend on Vapi's applicable service architecture, routing, and contractual documentation. Hisenbug does not directly configure downstream routing or contract with downstream providers for live calls.

3. Customer-Controlled External Destinations

The following services are customer-configured notification destinations, rather than Hisenbug Subprocessors:

  • Slack:
    • Classification: Slack is a customer-configured external notification destination. The legal classification of that destination may depend on applicable data protection law and the customer's configuration.
    • Role: Customer-controlled notification destination.
    • Data Flow: Strictly outbound lead notification cards dispatched via chat.postMessage.
    • Data Isolation: Hisenbug does not ingest Customer Slack message history. Delivered notifications reside in Customer's own Slack workspace and are subject to Customer's enterprise retention policies. Hisenbug does not possess capabilities to remotely delete messages once delivered into a Customer's workspace.

4. Explicit Non-Subprocessor Exclusions

For absolute clarity and factual alignment, the following entities are NOT Subprocessors of Hisenbug:

  1. n8n GmbH (Berlin, Germany):
    • Status: NOT A SUBPROCESSOR.
    • Technical Reality: n8n is an open-source software application self-hosted inside an isolated Docker container on Hisenbug's Oracle Cloud VPS. It communicates strictly over local host loopback (127.0.0.1:5678). Zero Customer Data is transmitted to n8n GmbH. Workflow execution data is automatically pruned after 72 hours.
  2. Direct ElevenLabs Developer Account (ELEVENLABS_API_KEY):
    • Status: NOT A PRODUCTION SUBPROCESSOR.
    • Technical Reality: Forensic code-path analysis conclusively established that the direct ELEVENLABS_API_KEY referenced in repository configuration is utilized solely by an offline developer CLI utility (scripts/refresh-voice-previews.js) that performs static GET /v1/voices/{voiceId} metadata queries to update voice preview URLs. It is completely isolated from live call routing, customer portal operations, CRM databases, and post-call workflows. Live call voice synthesis is mediated exclusively through Vapi.

5. Subprocessor Due Diligence & Security

Before onboarding new direct Subprocessors, Hisenbug conducts technical and operational due diligence to verify that each provider:

  • Implements robust technical and organizational security controls (including transit encryption and tenant isolation);
  • Executes a compliant Data Processing Addendum incorporating appropriate international transfer mechanisms (such as EU Standard Contractual Clauses); and
  • Maintains appropriate business continuity and disaster recovery safeguards.

For questions regarding our Subprocessors, contact hello@hisenbug.com.