Subprocessors

Effective Date: April 5, 2026 Last Updated: July 29, 2026 Version: 2.3

Overview

hiroi (TrentApps LLC) uses the following third-party service providers ("sub-processors") to process data as part of the hiroi omni-channel AI agent platform. This list is maintained in accordance with our Data Processing Agreement.

Which providers actually receive your data depends on how your account is configured. Some entries below are engaged only when you enable a specific feature — connecting a calendar, selecting a particular voice, choosing a particular AI model. Those are marked conditional. The hosted hiroi cloud routes AI processing through Azure OpenAI by default.

Current Sub-Processors

Sub-Processor	Purpose	Data Processed	Location	Engaged
Microsoft Azure	Application hosting, database, content safety, maps	All application data (encrypted); Azure SQL Database; Azure AI Content Safety analysis; Azure Maps queries where local search is enabled	United States (East 2)	Always
Azure OpenAI (Microsoft)	Primary AI provider: response generation, embeddings, speech-to-text	Chat and call messages, transcripts, system prompts, knowledge base content, text for embeddings, voice audio for transcription	United States (East 2)	Always
Azure Speech (Microsoft)	Speech-to-text and text-to-speech	Voice audio (widget and phone), assistant reply text	United States	Always
Azure Communication Services (Microsoft)	Outbound/inbound voice calls, SMS, and email delivery	Phone numbers, call audio, call metadata, SMS content, email addresses and content	United States	When calling, SMS, or email is enabled
Cloudflare	CDN, DNS, DDoS protection, WAF	Network traffic metadata, IP addresses	Global (edge network)	Always
Stripe	Payment processing and subscription management	Customer ID, payment method tokens, transaction data	United States	On payment
OpenAI	AI response generation, embeddings, speech-to-text	Chat messages, transcripts, system prompts, text for embeddings, voice audio	United States	Conditional — only where a deployment is configured to call OpenAI directly instead of Azure OpenAI
Anthropic	AI response generation (Claude)	Chat messages, transcripts, system prompts, knowledge base content used as context	United States	Conditional — only where an assistant is configured to use a Claude model
ElevenLabs	Text-to-speech	The text of assistant replies	United States	Conditional — only where an ElevenLabs voice is selected
Google	Authentication; Google Workspace integration	OAuth tokens; calendar and email data where the integration is connected	United States	Conditional
Apple	Authentication (Sign in with Apple)	OAuth tokens	United States	Conditional
Microsoft (Entra ID / Graph)	Authentication; Microsoft 365 integration	OAuth tokens; calendar, email, Teams, and directory data where the integration is connected	United States	Conditional

Self-hosted Enterprise deployments run inside the customer's own Azure tenant and engage only the providers that customer configures. The list above describes the hosted hiroi cloud.

Sub-Processor Details

Microsoft Azure (hosting, database, AI, speech, telephony)

Service: Azure Container Apps for application hosting; Azure SQL Database for persistent storage; Azure OpenAI for AI inference, embeddings, and speech-to-text; Azure Speech for transcription and voice synthesis; Azure AI Content Safety for per-message content moderation; Azure Communication Services for calls, SMS, and email; Azure Maps for local place search where enabled
Data processed: All application data is hosted on Azure infrastructure. Azure SQL stores all persistent data including user accounts, contact records, AI agent configurations, transcripts, message logs, conversation history, consent records, and opt-out records. Azure OpenAI and Azure Speech receive conversation text and voice audio for processing in real time. Azure AI Content Safety analyzes chat messages for harmful content before AI processing. Application secrets are stored in Azure Container Apps environment secrets
Data retention by sub-processor: Application data is retained per our retention schedule. Azure OpenAI abuse-monitoring behaviour is governed by Microsoft's Azure OpenAI service terms
Security: SOC 2 Type II, ISO 27001, FedRAMP, HIPAA eligible, EU-US Data Privacy Framework participant

Azure Communication Services (ACS)

Service: Outbound and inbound AI phone calls; outbound and inbound SMS; email delivery
Data processed: Phone numbers provisioned through ACS; call audio and call metadata (duration, caller ID, outcome); SMS message content (outbound and inbound); email addresses and email content
Regulatory coverage: ACS provides carrier-grade telephony subject to FCC regulations. A2P 10DLC registration for US SMS is managed through ACS
Data retention by sub-processor: Subject to Microsoft's communications data retention terms. Call audio is carried and transcribed in real time and is not persisted by hiroi
Security: SOC 2 Type II, ISO 27001, FedRAMP, HIPAA eligible

OpenAI (conditional)

Service: OpenAI API for AI response generation, text-embedding-3-small for document and query embeddings, and speech-to-text. Engaged only where a deployment is configured to call the OpenAI API directly rather than Azure OpenAI
Data processed: Conversation messages, transcripts, system prompts, knowledge base content, and voice audio for transcription
Data retention by sub-processor: Under OpenAI's default API terms, customer content is not used to train their models, and abuse-monitoring logs are retained for up to 30 days unless a longer period is legally required. Zero Data Retention is a separate arrangement that OpenAI must approve; we do not currently claim a Zero Data Retention agreement with OpenAI. See OpenAI's data controls documentation
Security: SOC 2 Type II certified

Anthropic (conditional)

Service: Claude API for AI response generation. Engaged only where an assistant is configured to use a Claude model
Data processed: Conversation messages, transcripts, and configured system prompts. Knowledge base content may be included as context
Data retention by sub-processor: Under Anthropic's commercial API terms, inputs and outputs are not used to train their models. Retention periods for standard API traffic, including longer retention of content flagged by trust and safety systems, are set out in Anthropic's privacy policy and trust center
Security: SOC 2 Type II certified

ElevenLabs (conditional)

Service: Text-to-speech synthesis. Engaged only where the assistant owner selects an ElevenLabs voice; Microsoft Azure is the default voice provider
Data processed: The text of assistant replies sent for synthesis. No contact records, transcripts, or account data are sent
Data retention by sub-processor: Per ElevenLabs' privacy policy
Security: SOC 2 Type II certified

Stripe

Service: Payment processing, subscription management, and invoicing
Data processed: Payment method tokens, customer identifiers, transaction metadata, and credit balance events. hiroi does not handle or store raw payment card data
Data retention by sub-processor: Subject to Stripe's data processing agreement and PCI-DSS requirements
Security: PCI-DSS Level 1, SOC 2 Type II certified

Cloudflare

Service: CDN, DNS resolution, DDoS protection, Web Application Firewall (WAF)
Data processed: Network traffic metadata (IP addresses, request headers, URLs) for routing, security, and performance. TLS is terminated at the Cloudflare edge, so Cloudflare processes request content in transit; it does not have access to our database or to stored application data
Data retention by sub-processor: Network logs retained short-term per Cloudflare's data processing terms
Security: SOC 2 Type II, ISO 27001, EU-US Data Privacy Framework participant

Identity providers: Google, Apple, Microsoft (conditional)

Service: Sign-in via OAuth 2.0, and — where you explicitly connect the integration — access to your calendar, email, and (for Microsoft) Teams and directory data
Data processed: OAuth tokens, and the calendar/mail/directory data the connected integration reads or writes on your behalf. Tokens are encrypted at rest and never sent to the browser
Data retention by sub-processor: Per each provider's own privacy policy — Google, Apple, Microsoft
Note: These providers act as sub-processors only for the integration data they process on your instruction. For your own relationship with them as a user of their services, they are independent controllers

Provider Retention References

Sub-Processor	Reference
Microsoft Azure / Azure OpenAI / ACS	Microsoft Privacy Statement · Azure OpenAI data privacy
OpenAI	OpenAI data controls
Anthropic	Anthropic Privacy Center
ElevenLabs	ElevenLabs Privacy Policy
Stripe	Stripe Privacy Policy
Cloudflare	Cloudflare Privacy Policy

Provider terms change. These links point at each provider's current published policy, which controls over any summary on this page.

Changes to Sub-Processors

In accordance with our Data Processing Agreement:

We notify customers at least 30 days before engaging a new sub-processor
Notifications are sent via email to the account owner's registered email address and posted to this page
Customers may object to new sub-processors within 14 days of notification
This page is updated when sub-processor changes take effect

To receive notifications about sub-processor changes, ensure your account email is up to date in your account settings.

Contact

For questions about our sub-processors:

TrentApps LLC (d/b/a hiroi) — Privacy 117 S Lexington St, Ste 100 Harrisonville, MO 64701, United States Email: privacy@hiroi.ai