Sub-processors
The third parties that process Customer Data for Vora, what each one receives, and where.
Last updated November 4, 2026
Draft for counsel review
In short
- These companies process Customer Data on Vora's behalf to run the Service. Each is bound by written data protection terms.
- All of them process Customer Data in the United States.
- AI providers receive data only if your agency turns the matching feature on.
- We give 30 days' notice before adding a new sub-processor, and you can object.
This summary is for convenience. The full text below governs.
1. About this list
This page is Annex C of Vora's Data Processing Addendum. Terms such as Customer Data, Client Data and Sub-processor have the meanings given there.
A Sub-processor is a third party that Vora engages and that processes Customer Data for Vora in providing the Service. Vora assesses each one before use, puts written data protection terms in place, and remains responsible for it.
[COUNSEL: before this page is published as final, confirm that a signed or click-through DPA is in place with each Sub-processor below, and confirm that Vora's Vercel plan supports and enforces request-level zero data retention through the AI Gateway for Anthropic and OpenAI.]
2. Current sub-processors
| Sub-processor | Purpose | Data | Location | Notes |
|---|---|---|---|---|
| Supabase, Inc. | Database, authentication and file storage | All Customer Data held in the Service: Client, deal and policy records, consent and do-not-call records, user accounts and two-factor factors, call recordings and transcripts, lead files, exports, uploaded files, encrypted secrets | United States (AWS us-east-1) | Primary data store. Encryption at rest by the provider. Daily backups. |
| Vercel, Inc. | Application hosting, content delivery and AI Gateway | Customer Data in transit through the web application; requests routed through the AI Gateway for opt-in AI features | United States (application functions); requests pass through Vercel's global edge network | The AI Gateway is configured with zero data retention and no prompt training on every request. |
| Railway Corporation | Background workers and dialer state | Customer Data processed by background jobs (imports, exports, recordings, messages); short-lived dialer state (locks and in-flight call state, no Client records) in a private Redis instance | United States (us-east4) | The Redis instance has no public address and can be rebuilt from the database. |
| Telnyx LLC | Voice calls, call recording, text messaging and phone number registration | Phone numbers, call audio and recordings, text message content, delivery status; for number registration (KYC and 10DLC), the agency's legal name, EIN and business address | United States | Recordings are copied into Vora's storage after each call. |
| Resend, Inc. | Email delivery | Recipient email addresses, names and email content (sign-in codes, invitations, notifications) | United States | Sends from notifications.vorafinancial.io and support.vorafinancial.io. |
| Functional Software, Inc. (Sentry) | Error and performance monitoring | Technical error data and traces. Personal data collection is turned off and events are scrubbed before they leave the Service | United States | Should not receive Client Data. Any that slips through is treated as a security incident and deleted. |
| Anthropic, PBC (through the Vercel AI Gateway) | Opt-in AI features: Data Assistant, report-layout mapping, call summaries | Masked and aggregated data for the Data Assistant; spreadsheet headers and masked cell shapes; call transcripts for summaries | United States | Off by default. Zero data retention and no training through the Gateway. |
| OpenAI, L.L.C. (through the Vercel AI Gateway) | Opt-in call transcription | Call recording audio | United States | Off by default. Zero data retention and no training through the Gateway. |
| ElevenLabs, Inc. | Opt-in recording audio cleanup; generated voice audio files | Call recording audio (cleanup); text of prompts and disclosures the agency or Vora writes (generated audio) | United States [COUNSEL: confirm ElevenLabs' processing location] | Off by default. Called directly, not through the AI Gateway, so the Gateway's zero-retention setting does not apply. [COUNSEL: confirm ElevenLabs' zero-retention mode is enabled for Vora's account and its DPA terms before the feature is turned on.] |
| Stripe, Inc. | Subscription billing and payments (when billing is enabled) | Billing contact name and email, subscription and invoice records. Card details go to Stripe directly and never reach Vora | United States | Listed for when billing is enabled. Not processing data today. |
3. Customer-directed integrations (not Vora sub-processors)
The services below receive or supply data only because the Customer chooses to connect or use them. They are the Customer's vendors, under the Customer's own terms with them. Vora sends data to them, or receives data from them, on the Customer's instruction.
| Service | What happens | Data | Who chooses it |
|---|---|---|---|
| Discord (webhooks) | Posts sales, approvals and leaderboard updates to a Discord channel the agency names | Whatever the agency's post templates include, typically agent names and deal summaries | Agency admin, in Settings > Integrations |
| Agency outbound webhooks | Sends signed event notifications to an address the agency configures | Event data the agency selects; no Client personal data in the default payloads | Agency admin |
| Insurance carriers (portals and reports) | The agency downloads policy and commission reports from carriers and uploads them to the Service | Policy, client and commission data in the carrier's report | The agency |
| Lead vendors | Send leads into the Service through a lead file or the vendor API key the agency issues | Lead name, contact details, date of birth, consent details and free-form vendor fields | The agency |
| Consent certificate providers (TrustedForm, Jornaya, comply.support) | Lead vendors supply a certificate ID or link that the Service stores with the consent record | Certificate IDs and URLs | The agency and its lead vendors |
| NIPR (National Insurance Producer Registry) | Agents upload their own licence report so the Service can record their licensed states. The PDF is deleted 1 hour after upload. Vora does not connect to NIPR's systems today | Agent licence data | The agent |
4. Vendors that do not receive Customer Data
Vora also uses vendors that never receive Customer Data, so they are not Sub-processors. For example, GitHub (source code hosting) and Blacksmith (continuous-integration runners) hold Vora's code and run its automated tests on synthetic data only.
5. Changes and notice
Vora will give at least 30 days' notice before a new Sub-processor starts processing Customer Data. Vora will update this page and email the account owner of each Customer agency.
To get these notices by email, write to info@vorafinancial.io with the subject "Sub-processor updates" and the email address to notify.
A Customer may object to a new Sub-processor on reasonable data protection grounds within the notice period, as set out in section 10 of the Data Processing Addendum.
In an emergency (for example, a provider's security failure), Vora may replace a Sub-processor with shorter notice and will tell Customers as soon as it can.
Questions: info@vorafinancial.io, 786-654-1233.
Version 2026-11-04