What is a subprocessor?

Modern software is assembled rather than built. A product you buy from one company is running on infrastructure from several others.

An AI phone assistant is a clear example. The carrier moves the call, one service transcribes it, another generates the reply, a third speaks it.

Your data passes through each of them. The vendor's own privacy policy describes only the layer they operate.

Published lists are the norm among mature vendors, along with notice before a new one is added. Their absence is informative.

Say one of your customers calls to book a furnace tune-up and talks to an AI phone assistant for three minutes. Count who handled her voice. Her carrier and yours moved the call. A telephony platform turned it into internet audio. Next, a speech-to-text service turned that audio into words. A language model provider read those words and wrote the reply, and a text-to-speech service spoke it. Finally, a cloud host stored the recording and the transcript.

You signed a contract with one of those companies. The rest are its subprocessors, and each has its own terms about how long it keeps what it's sent and whether it may learn from it. Your vendor's privacy page can be excellent and still tell you nothing about the speech service that heard your customer give her address.

Mature vendors publish a page, usually linked from the privacy policy, with a table naming each company and what it does. When you have it, check a few things. Does the list cover every stage of a call, or does it stop at the hosting provider? Is there a date on it, and a way to subscribe to changes? Does your contract promise notice before a new one is added? Thirty days is a common term.

Then pick the entry that touches the most sensitive data. For phone calls that's the transcription or language model provider. Ask one question about it: is our call data kept by them after processing, and is it used for training? A vendor who knows will answer in a sentence.

If you're a florist, you can skip this diligence. Once your callers mention health, money or legal trouble, it's the first thing to ask, and the written answer belongs in your files.

GreetKeeper is new and publishes no subprocessor list yet. That is a gap rather than a position, and it is worth knowing before a review.

Ask us directly and we will tell you what sits in the path rather than deflect the question.

This is also the reason we make no HIPAA claim. Compliance there is contractual and needs agreements with every layer touching patient information, which we do not hold.