These are the third-party services that process customer data on our behalf to operate TimberSwitch. We chose each one for a specific reason and we list every one — no hidden ad networks, no behavioral trackers, no data resellers. If you need a Data Processing Addendum (DPA) covering this list, email [email protected].
Active subprocessors
| Subprocessor | Purpose | Data type | Region |
|---|---|---|---|
| Telnyx privacy policy |
Voice + SMS carrier; phone number provisioning; voicemail recording | Call metadata, audio recordings, phone numbers | US |
| Amazon Web Services privacy policy |
Application hosting, database, voicemail audio storage | All customer data at rest, encrypted | US (us-east-1) |
| Stripe privacy policy |
Payment processing, subscription billing | Billing email, last 4 of card, plan + usage | US |
| Cloudflare privacy policy |
Edge network, DDoS protection, TLS termination, optional Web Analytics | Request metadata, IP addresses, aggregate page views | Global edge |
| Zoho Mail privacy policy |
Outbound transactional email (welcome, password reset, voicemail notifications) | Email contents we send to you | US |
| OpenAI API data policy |
Voicemail transcription (Whisper API), only when transcription is enabled. Per OpenAI's API policy your data is not used to train their models. | Voicemail audio (transient; not stored at OpenAI) | US |
| Microsoft privacy policy |
Optional sign-in with Microsoft (OpenID Connect) | Name, email, stable user identifier — only when you choose to sign in with Microsoft | US / EU |
| Google privacy policy |
Optional sign-in with Google (OAuth) | Name, email, stable user identifier — only when you choose to sign in with Google | US |
| GitHub privacy policy |
Source code hosting; no customer data crosses this boundary | Source code only | US |
What we don't use
- No third-party advertising networks. No retargeting pixels.
- No behavioral analytics products (no Mixpanel / Amplitude / Segment / Heap).
- No session-replay tools (no FullStory / LogRocket / Hotjar).
- No data brokers or marketing-list resellers.
- No customer-facing chat widgets that share content with a third party.
How we add or change subprocessors
When we plan to add or change a subprocessor that processes customer data, we email every workspace owner at least 14 days before the change takes effect. You can object — if you do, we work with you to find an alternative or, if no alternative exists for that functionality, we'll help you migrate off TimberSwitch with a prorated refund.
Questions or DPA requests
Email [email protected] with the subject "DPA request" or any privacy question. We respond within 5 business days.