Sub-processors
Last updated:
These are the third parties Nateq uses to process our customers' personal data, as listed in Annex 3 of our Data Processing Agreement. Each one receives only the data its function needs.
We give customers 30 days' notice by email before adding or replacing a sub-processor.
To get that notice without being a customer, email legal@nateq.io.
A. Sub-processors
Always in the data path.
| Provider | Function | Data | Location | Acceded to SDAIA SCCs | No-training terms confirmed |
|---|---|---|---|---|---|
| Amazon Web Services | Hosting, database, files, cache, CDN | All Customer Personal Data | Germany (eu-central-1) | Not yet | Yes |
| Google (Gemini) | AI replies, summaries, embeddings, voice-note transcription, AI memory | Message text, conversation history, contact facts, call transcripts, voice-note audio | Global endpoint, no region set | Not yet | Yes |
| TypeSafe AI (Jev) | AI routing decisions | Conversation text and decision context | United States | Not yet | Pending |
| ElevenLabs | Speech-to-text and text-to-speech on calls | Caller audio, AI reply text, voicemail audio | United States | Not yet | Pending |
| LiveKit | Real-time call media | Live call audio, phone numbers | United States | Not yet | Yes |
| Meta Platforms | WhatsApp, Messenger and Instagram delivery | Messages, media, phone numbers and IDs | Meta data centres (global); messages kept up to 30 days | Not yet | Processor for Cloud API; messages not used for ads; kept up to 30 days; AI training not addressed in Meta's terms |
| Resend | Email sending and receiving | Email content, addresses, attachments | Ireland | Not yet | Yes |
| Postmark | Workspace email subdomains for inbound mail and campaign replies; backup email sending | Email content, addresses, attachments | United States | Not yet | Yes |
| Sentry | Error tracking | Error events with personal data filtered | Germany | Not yet | Yes |
| Cloudflare (Turnstile) | Bot protection on widget and forms | Visitor IP, browser signals | Cloudflare network | Not yet | Yes |
Acceded to SDAIA SCCs: whether the provider has signed the Saudi Standard Contractual Clauses, which onward transfers of data of individuals in the Kingdom require (DPA 6.3). Until one has, a customer can ask us to turn off the features that use it.
No-training terms confirmed: whether we have confirmed the provider's terms do not let it train on the data (DPA 9.2).
B. Customer-enabled integrations
Services a customer connects itself, such as its CRM, help desk, store or mailbox. They receive data only on the customer's instruction and under the customer's own contract with the provider. They are not Nateq's sub-processors (DPA 5.4).
- Gmail and Google Workspace, Microsoft 365
- HubSpot, Salesforce, Pipedrive, Zoho CRM
- Zendesk, Freshdesk
- Shopify, Salla, Zid, Foodics, WooCommerce, Meta catalog
- Aramex, DHL, SMSA
- Slack, Microsoft Teams
- Notion, Asana, Jira, Trello
- Google and Microsoft calendars
- Customer's own webhooks