Sub-processors
Last updated: 24 October 2026
We Are One 1 Limited, trading as SONIQ Labs, is a company registered in England and Wales (company number 15052885). Registered office: 124 City Road, London, EC1V 2NX, United Kingdom. Registered with the Information Commissioner's Office as a data controller, registration number ZB976321.
These are the third parties we use to process personal data on behalf of our customers. Each is bound by written data protection terms at least as protective as our Data Processing Addendum. We remain responsible to our customers for what they do.
Where a provider processes data outside the UK, we rely on the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the UK-US Data Bridge, as shown. Some features, such as the in-app assistant, voicemail transcription and generated voices, use US providers; customers can ask us which features use which provider.
We give customers and partners at least 30 days' notice before adding or replacing a sub-processor. Customers may object on reasonable grounds, and if we cannot resolve the objection they may end the affected service without penalty. To be notified, email [email protected].
Platform infrastructure
| Provider | Purpose | Personal data | Location | Safeguard |
|---|---|---|---|---|
| Supabase Inc. ISO 27001:2022, SOC 2 Type II | Primary database, user sign-in and file storage | All customer account data: users, call records, transcripts, AI summaries, contacts, settings | United Kingdom (London) | Data stored in the UK. Supabase DPA with UK Addendum for support access |
| Cloudflare, Inc. ISO 27001, ISO 27701, ISO 27018, SOC 2 Type II, PCI DSS, Cyber Essentials | Call control, recording and voicemail storage, on-platform AI processing, network security, DNS | Live call state, recordings, voicemails, transcripts and text sent for AI summaries | Global network; United States (company) | Cloudflare DPA with UK Addendum; UK-US Data Bridge |
| Soniox, Inc. ISO 27001:2022, SOC 2 Type II | Live speech-to-text, voicemail transcription and text-to-speech | Call and voicemail audio, transcripts | European Union (Soniox EU region) | Data stays in the EU region; Soniox DPA. No training on customer data |
| IONOS SE | UK voice servers that connect calls | Call audio in transit, call signalling and call logs | United Kingdom | Data stays in the UK |
| Vercel Inc. | Hosting of the web portal and its APIs | Portal requests and responses passing to the database | United Kingdom (London) region; United States (company) | Vercel DPA with UK Addendum |
| PeaSoup Hosting Ltd UK G-Cloud supplier; Veeam-accredited data centre | Disaster-recovery copy of our Cloudflare R2 storage, and write-once retention for regulated recordings | Recordings, voicemail and files (encrypted copies); encrypted backups | United Kingdom | Data stays in the UK |
| Boxd | Isolated cloud workspaces for AI agent sessions | Content an AI agent is working on for the customer | European Union | Data stays in the EU |
| Ably Realtime Ltd | Real-time updates to apps and wallboards | Presence, call notifications and live status | United Kingdom / European Union | Ably DPA |
| Upstash, Inc. | Short-lived call routing state | Call identifiers and routing state, kept for minutes | United States (company) | Upstash DPA with UK Addendum |
AI, voice and messaging
| Provider | Purpose | Personal data | Location | Safeguard |
|---|---|---|---|---|
| Google LLC | In-app AI assistant (Gemini), Android push notifications (Firebase), business caller ID lookups (Places) | Text the user asks the assistant about; notification payloads; business phone numbers | United States | Google Cloud DPA with UK Addendum; UK-US Data Bridge |
| OpenAI, L.L.C. | Selected AI features: recruitment tools and AI agent setup | Text the user submits to those features | United States | OpenAI API DPA with UK Addendum. API data is not used for training |
| ElevenLabs, Inc. | Generated voices for greetings and AI agents | Text to be spoken | United States | ElevenLabs DPA with UK Addendum |
| Resend, Inc. | Platform email: voicemail-to-email, notifications, invitations | Recipient address and message content | United States | Resend DPA with UK Addendum |
| VoodooSMS Ltd | SMS sending | Mobile number and message content | United Kingdom | Data stays in the UK |
| Twilio Inc. | Number lookups and selected numbers | Phone numbers and call signalling for those numbers | United States | Twilio DPA with UK Addendum; UK-US Data Bridge |
| Apple Inc. | iPhone push notifications for incoming calls | Notification payload (caller name and number) | United States | Apple developer terms; UK-US Data Bridge |
| Composio, Inc. and Nango (Nango Software Inc.) | Secure connection to third-party apps a customer chooses to link | Access tokens and the data passed to those apps | United States | Provider DPAs with UK Addendum |
| Yealink Network Technology Co., Ltd. | Desk phone redirection service (RPS) | Device MAC address and provisioning address only | China (company) | No personal data beyond device identifiers |
Connectivity and billing
| Provider | Purpose | Personal data | Location | Safeguard |
|---|---|---|---|---|
| UK network carriers (OneHub, Value Communications) | Connecting calls to the public phone network and hosting phone numbers | Calling and called numbers, call signalling and audio in transit | United Kingdom | Ofcom-regulated carriers; data stays in the UK |
| Stripe Payments UK Ltd PCI DSS Level 1 | Card payments and payment links | Billing contact and payment details (card numbers never touch SONIQ) | United Kingdom / United States | Stripe DPA with UK Addendum |
| GoCardless Ltd | Direct Debit collection | Billing contact and bank mandate details | United Kingdom | Data stays in the UK |
Apps a customer connects
When a customer links its own systems, such as Microsoft 365, Google Workspace, a CRM or a practice-management system, that provider works for the customer under the customer's own contract. It is not our sub-processor. We access it only as the customer authorises.