> ## Documentation Index
> Fetch the complete documentation index at: https://docs.famulor.io/llms.txt
> Use this file to discover all available pages before exploring further.
# Trust Center
> Transparency on Famulor's infrastructure, sub-processors, and technical safeguards
At Famulor, **data sovereignty** is a baseline requirement of modern AI communication. This Trust Center gives full transparency into our infrastructure, our specialized sub-processors, and the technical safeguards that protect sensitive data.
This page serves as a living annex to our Data Processing Addendum (DPA) and is updated regularly to match our current technology stack. Terms like LLM, STT, TTS, SIP trunk, or realtime model are explained in the [Glossary](/glossary).
## Infrastructure security
Every layer of our platform is built on security-first principles.
### Encryption
AES-256 encryption at rest, TLS 1.3 in transit. Voice data, transcripts, and customer information are encrypted end-to-end across the full call lifecycle.
### Access control
Role-based access control (RBAC) and least-privilege principles across all systems. Every access is logged and auditable.
### Monitoring & detection
24/7 security monitoring with intrusion-detection systems, anomaly alerting, and comprehensive audit logging for all system activity.
### Business continuity
Automated backups, disaster-recovery procedures, and a 99.9% availability SLA. Redundant infrastructure across multiple availability zones.
### Incident response
A documented incident-response plan with defined escalation procedures, compliance with GDPR's 72-hour breach-notification requirement, and post-incident review.
### Sub-processor security
Every AI sub-processor is reviewed for security and compliance before it's added to the platform. Native, EU-resident plugins are used wherever available for the highest-sensitivity workloads (see [Speech services](#5-speech-services-stt--tts) below).
## 1. Our sovereignty commitments
To meet the strict requirements of the European market — including GDPR Art. 9 for healthcare and other sensitive-data use cases — we operate on four principles:
| Principle | Description |
| --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **EEA-first policy** | Core processing of voice and text data runs on servers within the European Economic Area (EEA), hosted out of Frankfurt, Germany. |
| **No-training guarantee** | We contractually ensure that none of our AI providers may use your data (audio, transcripts, or prompts) to train or improve their base models. |
| **Minimization by default** | [Retention](/settings/data-retention) is configurable per data channel, down to as little as one month, with automatic deletion once a record expires. |
| **Encryption everywhere** | All data is encrypted in transit with TLS 1.2+ and at rest with AES-256. |
An earlier version of this page described a "Zero Retention Mode" that processed data purely in memory. That specific mode is not part of the current platform — minimization today works through the configurable retention windows above, down to one month. If your organization needs a stricter guarantee, contact [support@famulor.io](mailto:support@famulor.io).
## 2. System status & availability
Transparency about system performance matters to us. You can check live status at any time:
**Live status:** [https://status.famulor.io/](https://status.famulor.io/)
## 3. Infrastructure & platform hosting
These providers host the Famulor platform, including backend logic, databases, and the customer dashboard.
| Provider | Purpose | Processing location |
| ----------- | ------------------------------------------------- | ----------------------- |
| Vercel Inc. | Application hosting, frontend, and edge functions | Frankfurt, Germany (EU) |
| Supabase | Database, authentication, and file storage | EU region |
## 4. Artificial intelligence (LLM)
These models handle reasoning and conversation logic. Model access is routed through an AI gateway with enterprise-grade data handling; native, direct connections are used for select providers where EU data residency requires it.
**Note:** LLM, STT, TTS, and SIP trunk providers are selectable per assistant, depending on the use case.
| Provider | Model / service | Processing location |
| ------------------------- | -------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- |
| Microsoft Ireland (Azure) | OpenAI models (GPT-4o, GPT-4o mini, and successors) | EU regions (Sweden Central) |
| Google Cloud (Vertex AI) | Gemini models, and **Gemma** (Google's open-source model family) for select Pipeline-mode configurations | EU regions (EU Data Residency) |
| Anthropic, PBC | Claude models (via EU-resident routing) | EU regions |
| Groq, Inc. | High-speed inference for select open-weight models | Verify current region with [support@famulor.io](mailto:support@famulor.io) |
## 5. Speech services (STT & TTS)
Specialized providers for real-time transcription (speech-to-text) and speech synthesis (text-to-speech). Famulor's engine-mode architecture (Pipeline / Realtime / Half-Cascade) determines which of these run for a given assistant.
**Note:** LLM, STT, TTS, and SIP trunk providers are selectable per assistant, depending on the use case.
| Provider | Category | Service / purpose | Processing location |
| ----------------------------------------------------------------------------------------- | ----------------------- | ---------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------- |
| [Deepgram, Inc.](https://deepgram.com/learn/deepgram-eu-endpoint-now-generally-available) | STT / TTS | Real-time transcription (Nova) and voice synthesis (Aura) | EU endpoint available (`api.eu.deepgram.com`); GDPR-compliant EU-region usage. |
| [Soniox, Inc.](https://soniox.com/docs/stt/security-and-privacy) | STT | High-accuracy transcription, native EU-resident plugin | EU region (`stt-rt.eu.soniox.com`), contractually restricted to EU nodes. |
| [Gladia SAS](https://gladia.io/compliance-hub) | STT | Real-time and batch speech-to-text, native EU-resident plugin | EU region (`eu-west`); EU and US workloads processed separately. |
| [ElevenLabs Inc.](https://elevenlabs.io/docs/overview/administration/data-residency) | TTS | Voice synthesis models | EU Data Residency (Enterprise) and EU endpoints available. |
| [Cartesia AI, Inc.](https://cartesia.ai/blog/gdpr-compliance) | TTS | Ultra-low-latency voice synthesis (Sonic) | GDPR-compliant per provider; EU region usable. |
| [Fish Audio](https://fish.audio/) | TTS | Voice synthesis | Verify current region with [support@famulor.io](mailto:support@famulor.io). |
| Microsoft Ireland (Azure) | STT / TTS | Azure Speech (native plugin, mandatory for this provider option) | EU regions; data stays in the region of the created resource. |
| Google Cloud (Vertex AI) | STT / TTS | Speech-to-Text and Text-to-Speech | EU regions (Vertex AI EU Data Residency). |
| [AssemblyAI](https://www.assemblyai.com/) | STT | Transcription | Verify current region with [support@famulor.io](mailto:support@famulor.io). |
| [Speechmatics](https://www.speechmatics.com/) | STT | Transcription | Verify current region with [support@famulor.io](mailto:support@famulor.io). |
| [Inworld AI](https://inworld.ai/) | TTS | Voice synthesis | Verify current region with [support@famulor.io](mailto:support@famulor.io). |
| [Rime AI](https://rime.ai/) | TTS | Voice synthesis | Verify current region with [support@famulor.io](mailto:support@famulor.io). |
| [LiveKit Inc.](https://docs.livekit.io/deploy/admin/regions/region-pinning/) | Realtime infrastructure | Virtual conversation rooms (realtime sessions) and, for most providers above, the default routing path to their models | EU-SCC. Famulor uses region pinning: per the provider, data does not leave the European region. |
| [Krisp Technologies](https://krisp.ai/) | Noise cancellation | Background-noise removal on live calls | Runs via LiveKit Cloud; verify current region with [support@famulor.io](mailto:support@famulor.io). |
Not every provider listed above processes every call. Famulor selects EU-resident, native connections for higher-sensitivity workloads (Soniox, Gladia, Azure) and uses a managed inference path for the rest — both are covered by the transfer safeguards in [section 10](#10-international-data-transfers--safeguards).
## 6. Business operations & billing
Providers for transactional security and administrative management.
| Provider | Purpose | Processing location |
| ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------- |
| Stripe Payments Europe | Secure payment processing (platform billing; customers may also connect their own Stripe account) | Ireland (EU) |
| Twilio Ireland Limited | Telephony, SIP trunking, and SMS | Ireland (EU). Regional processing via Twilio Regions (including IE1). |
| SendGrid (Twilio) | Transactional and system email, and the email conversation channel | EU regions (EU Data Processing Locations) |
| Meta Platforms Ireland Limited | WhatsApp Business Platform (Cloud API) — connected directly, not routed through Twilio | EEA, per Meta's Business Tools Terms |
| Composio | Brokers OAuth connections for the Agent Connectors / App Catalog integration library (e.g. Slack, HubSpot, Salesforce) — only active for the specific apps a workspace connects | Verify current region with [support@famulor.io](mailto:support@famulor.io). |
## 7. WhatsApp Business processing
For WhatsApp Business:
* The integration connects directly to **Meta's WhatsApp Cloud API** — not routed through Twilio.
* You can use either your **own WhatsApp-enabled number** or a number from the **Famulor number pool** (depending on setup/verification).
* If using your **own number**, the number owner must complete verification directly in **Meta Business Manager**.
* Inbound WhatsApp messages are processed through configurable **LLM workflows**.
* Replies are sent back as an **AI-generated message**.
* **Text, images, and voice messages** can be processed within the enabled assistant configuration and used for reply generation.
## 8. Platform analytics
For product analytics on the dashboard itself, Famulor uses:
| Provider | Purpose | Note |
| -------- | ----------------------- | ------------------------------------ |
| PostHog | Product usage analytics | EU Cloud region (`eu.i.posthog.com`) |
Famulor's documentation site (docs.famulor.io) separately uses Google Analytics 4 and Microsoft Clarity for content analytics — these do not process data from your workspace or calls. White-label customers may optionally connect their own Google Tag Manager, GA4, or Meta Pixel to their own branded domain; that configuration and its data are the customer's own.
## 9. Provider legal entities & addresses
The legal entity behind each provider, with a publicly available business address (as of the date below). Newer providers added since our last full review are marked — contact [support@famulor.io](mailto:support@famulor.io) for their current entity details pending the next quarterly update.
| Provider | Legal entity | Address | Source |
| -------------------------------------------------------------------------------- | ------------------------------------ | ------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------ |
| Vercel | Vercel Inc. | 440 N Barranca Ave #4133, Covina, CA 91723, USA | [Vercel Terms](https://vercel.com/legal/terms) |
| Supabase | Supabase, Inc. | *Pending next review — request current details from support* | — |
| Microsoft (Azure) | Microsoft Ireland Operations Limited | 70 Sir John Rogerson's Quay, Dublin 2, D02 R296, Ireland | [LEI Register](https://lei.info/549300WCLFVEBTBNRF76) |
| Google Cloud | Google Cloud EMEA Limited | 70 Sir John Rogerson's Quay, Dublin 2, Ireland | [Google Contracting Entity](https://cloud.google.com/terms/google-entity/index-20210816) |
| Anthropic | Anthropic, PBC | 548 Market Street, PMB 90375, San Francisco, CA 94104, USA | [OpenGov](https://opengovco.com/business/20241311617) |
| Groq | Groq, Inc. | *Pending next review* | — |
| Soniox | Soniox, Inc. | 1045 Helm Ln, Foster City, CA 94404, USA (EU site: Cesta v Gorice 34B, 1000 Ljubljana, Slovenia) | [Soniox Contact](https://soniox.com/contact) |
| ElevenLabs | Eleven Labs Inc. | 169 Madison Ave #2484, New York, NY 10016, USA | [ElevenLabs Help](https://help.elevenlabs.io/hc/en-us/articles/21757104682001-What-is-your-billing-address-and-VAT-EIN-number) |
| Deepgram | Deepgram, Inc. | 548 Market St, Suite 25104, San Francisco, CA 94104-5401, USA | [EU Endpoint Announcement](https://deepgram.com/learn/deepgram-eu-endpoint-now-generally-available) |
| Gladia | GLADIA SAS | 6B, rue du Bas Village, 35510 Cesson-Sevigne, France | [Gladia Legal Notice](https://www.gladia.io/legal-notice) |
| Cartesia | Cartesia AI, Inc. | 1766 18th Street, Suite 1200, San Francisco, CA, USA | [Company info](https://www.crunchbase.com/organization/cartesia) |
| Fish Audio / AssemblyAI / Speechmatics / Inworld AI / Rime AI / Krisp / Composio | — | *Pending next review — request current details from support* | — |
| LiveKit | LiveKit Inc. | 4285 Payne Avenue, Suite 9154, San Jose, CA 95157, USA | [Region pinning (LiveKit Docs)](https://docs.livekit.io/deploy/admin/regions/region-pinning/) |
| Stripe | Stripe Payments Europe, Limited | One Wilton Park, Wilton Place, Dublin 2, D02 FX04, Ireland | [LEI Register](https://lei.info/549300DSKP4KJP52XY61) |
| Twilio | Twilio Ireland Limited | 70 Sir John Rogerson's Quay, Dublin 2, D02 R296, Ireland | [LEI Register](https://lei.info/635400HZOP3LBSUGAN82) |
| SendGrid (Twilio) | Twilio Ireland Limited | 70 Sir John Rogerson's Quay, Dublin 2, D02 R296, Ireland | [LEI Register](https://lei.info/635400HZOP3LBSUGAN82) |
| PostHog | PostHog Inc. | *Pending next review* | — |
| Meta (WhatsApp Business Platform) | Meta Platforms Ireland Limited | 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland | [Meta Business Tools Terms](https://www.facebook.com/legal/technology_terms) |
## 10. International data transfers & safeguards
For providers with US parent companies (e.g. Microsoft, Google, Vercel, Groq, ElevenLabs, Deepgram, Cartesia, LiveKit), Famulor ensures compliance through:
* **Data residency:** configuring services so data is processed exclusively on EU nodes wherever the provider offers it.
* **Legal framework:** use of the EU-U.S. Data Privacy Framework (DPF) and/or Standard Contractual Clauses (SCCs).
* **Enterprise agreements:** contracts that exclude third-party access and model-training use of your data.
* **TIA on request:** for enterprise customers, Famulor prepares a Transfer Impact Assessment (TIA) on request, per EDPB Recommendations 01/2020, for any provider with a US parent company.
### Transfer legal basis per US-based provider
| Provider | Category | Transfer legal basis |
| ------------------------------------------------------------------- | -------- | ------------------------------------------------------------------------- |
| Deepgram | STT/TTS | SCCs (2021/914/EU) + EU endpoint (`api.eu.deepgram.com`) |
| Soniox | STT | SCCs + EU Data Residency (contractually restricted to EU nodes) |
| Gladia | STT | SCCs (2021/914/EU), separate EU/US workloads |
| Cartesia | TTS | SCCs + EU Data Residency |
| LiveKit | Realtime | SCCs + region pinning (per provider, no processing outside the EU region) |
| ElevenLabs | TTS | Enterprise DPA + EU Data Residency |
| Vercel | Hosting | DPF (certified) + EU region (Frankfurt) |
| Anthropic | LLM | SCCs via EU-resident routing |
| OpenAI (via Azure) | LLM | DPF (via Microsoft) + Azure EU nodes |
| Groq, Fish Audio, AssemblyAI, Speechmatics, Inworld, Rime, Composio | Various | *Pending next review* — request current status from support |
For providers without DPF certification, Famulor has executed the EU Standard Contractual Clauses under EU Commission Decision 2021/914/EU (Module 2: Controller to Processor). These are available to enterprise customers on request.
To independently verify a provider's DPF certification: [Data Privacy Framework Participants List](https://www.dataprivacyframework.gov/list)
## 11. Data retention
Retention periods are available in your **account** and configurable per data category.
| Data category | Default | Configurable range (maximum) |
| ------------- | ------------------------------------ | ---------------------------- |
| Calls | Account default (visible in account) | 1 to 24 months |
| Contacts | Account default (visible in account) | 1 to 24 months |
| Chats | Account default (visible in account) | 1 to 24 months |
| SMS | Account default (visible in account) | 1 to 24 months |
## 12. Technical and organizational measures (TOMs)
Our security framework targets maximum traceability and isolation:
| Measure | Description |
| --------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Multi-tenancy** | Strict logical separation of customer data. Every workspace runs in an isolated environment. |
| **Reseller & white-label architecture** | A whitelabel-entitled workspace gets its own admin panel to centrally manage multiple, fully separated customer workspaces. |
| **Access control** | Access follows least-privilege [workspace roles](/settings/workspaces). Every user can enable [two-factor authentication](/account-security) on top of their password. |
| **User-controlled data retention** | To implement GDPR's storage-limitation principle, users can independently configure automatic deletion windows (1 to 24 months) for calls, contacts, chats, and SMS. |
| **Audit logging** | **Settings → Data → Audit Log** records who changed what across the workspace, and when, for traceability. |
| **Continuity** | Automatic daily backups, encrypted and stored within the EU. |
## 13. Governance & maintenance
* This list is **reviewed quarterly**.
* Changes to the provider stack are documented in the **[Changelog](/changelog)**.
**Last updated:** 2026-08-27
## 14. Google API disclosure
Where Famulor's Google Calendar and other Google Workspace integrations use information from Google APIs, that use and any onward disclosure to other applications complies with the [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including its Limited Use requirements.
## Related pages
* [Support](/support)
* [Enterprise](/enterprise)
* [Data retention settings](/settings/data-retention)