Legal

Subprocessors

The companies that process data for Amfion: what each one does, the data it receives, where it processes it, and which AI model setting sends a business’s data to it.

Last updated September 28, 2026. The Terms for Amfion business accounts (section 9) and the Privacy Policy (section 4) describe the same providers; the Security page covers how Amfion protects the data itself.

At a glanceSeptember 28, 2026

Database, servers and backupsSupabase and Hetzner: Germany
AI on the US models settingan option for law firms: Anthropic · OpenAI
The phone conversationunder every setting: OpenAI
Card detailsStripe-hosted checkout: Stripe only
A new subprocessoremailed to each business first: 30 days’ notice

Which AI model setting uses which provider.

Each business chooses its AI model setting in Settings. The phone conversation itself runs on OpenAI under every setting, and test runs of the assistant follow the same routes as live conversations.

Recommended. Amfion picks the model for each task. The default for every business except law firms.

US-only AI providers. Anthropic and OpenAI only. A paid add-on for most businesses; included for law firms.

US-hosted open models. DeepSeek, an open model, through OpenRouter, limited to six US-based hosts. The law-firm default.

“US” describes the companies, not a guaranteed processing location. A preview built from a business’s public website before it signs up reads that website on the platform default; the preview’s conversations follow its model setting. The legal profile defaults to DeepSeek on the listed US-based hosts and also allows US models.
Provider	Recommended	US-only AI providers	US-hosted open models
Anthropic	FallbackA chat, text or email reply that fails or is slow to start, a message with a PDF, and reading the business’s website	MainReplies in chat, texts, WhatsApp and email, and reading the business’s website; for a law firm, the check of its replies for advice-shaped wording, a call’s included once it ends	FallbackAs on the platform default; for a law firm, the check of its replies for advice-shaped wording, a call’s included once it ends
OpenAI	Every settingThe phone conversation itself; a phone lookup when the DeepSeek route is slow or unavailable; document search; the owner’s setup assistant	Every settingThe phone conversation itself and the lookups behind each call; document search; the owner’s setup assistant	Every settingThe phone conversation itself; a phone lookup when the DeepSeek route is slow or unavailable; document search; the owner’s setup assistant
OpenRouter and its hosts	MainReplies in chat, texts, WhatsApp and email, the lookups behind calls, and website reading, on zero-retention hosts; a phone lookup may go to a host outside the United States	NeverReceives nothing from these businesses	MainThe same work, limited to the US-based hosts named below
Jina AI	Every settingFetches public website pages that need a browser, when a website is read	Every settingThe same	Every settingThe same

AI model providers

Which of these handles a business’s conversations depends on the business’s AI model setting (the table above). None of them uses the data to train models, under its published terms for business use or, through OpenRouter, a restriction on every request Amfion sends.

Anthropic

United States (San Francisco)

What it does: Claude writes the replies in chat, texts, WhatsApp and email and reads the business’s website for businesses on US models. On the other settings it is the fallback when the DeepSeek route fails or is slow to start, and it answers any message that includes a PDF. Where Amfion configures it for an account, it can also handle the lookups behind phone calls. For a law firm, whatever its setting, it also checks the assistant’s replies for anything that reads like legal advice after they are sent, including the assistant’s side of a phone call once the call has ended.
Data it receives: Each message and the conversation so far; the business’s instructions and published facts; the results of lookups and actions (availability, booking details, and the names and contact details a person gave); photos and PDFs sent in a conversation; the text of the business’s website when it is read. For a law firm’s reply check: each assistant reply, or each of the assistant’s turns of a call transcript, with the message it answered (a short reply with nothing legal in it is cleared without being sent).
Where it processes: Anthropic stores data in the United States. Its default routing may process requests in the United States, Europe, Asia or Australia, so US processing is not guaranteed.
How long it keeps data: Up to 30 days, for example to monitor for abuse; content Anthropic flags under its usage policy can be kept longer.
AI model setting: Recommended · US-only AI providers · US-hosted open models

OpenAI

United States (San Francisco)

What it does: The spoken assistant on phone calls and its transcript, under every setting. The lookups behind calls for businesses on US models, and the fallback for them otherwise. Search over a business’s own documents, the business owner’s setup assistant, and the recorded call notice.
Data it receives: Callers’ speech and the assistant’s speech in real time, and the transcript; the call’s instructions (the business’s facts and rules); the text of phone lookups (a caller’s request, the business’s details, names and callback numbers); excerpts of the business’s documents and the text of a customer’s question, for document search; the owner’s messages to the setup assistant. The recorded call notice is rendered from its fixed words only, with no customer data.
Where it processes: A US company. Amfion does not guarantee the region where OpenAI processes a request.
How long it keeps data: Up to 30 days for abuse monitoring; flagged content can be kept longer. Requests Amfion sends to OpenAI’s Responses API itself (the setup assistant, and phone lookups when Amfion runs them) ask OpenAI not to store the response.
AI model setting: Recommended · US-only AI providers · US-hosted open models

OpenRouter and the zero-retention hosts it routes to

OpenRouter: United States (New York)

What it does: Routes requests to DeepSeek V4.1 Flash, an open-weight model developed by DeepSeek, a company based in China, served by other companies’ servers. Never sent to DeepSeek’s own servers. Also reads a business’s public website to build a preview before the business signs up.
Data it receives: Conversation text in chat, texts, WhatsApp and email, with the business’s instructions and lookup results; the text of phone lookups; the text of a business’s public website when it is read. Never for a business on US models.
Where it processes: Not guaranteed: OpenRouter cannot fix a processing region on Amfion’s plan. On US-hosted open models, requests go only to Baseten, Fireworks AI, Together AI, DeepInfra, Parasail, Modal, which are US-based companies. On the platform default, chat and website reading exclude the hosts Amfion knows operate outside the United States, and a phone lookup goes to whichever zero-retention host answers fastest, which may be outside the United States.
How long it keeps data: Every request requires a zero-data-retention endpoint and refuses hosts that train on or keep its contents. This is enforced on each request, not by an account setting.
AI model setting: Recommended · US-hosted open models

Phone, texting and email

Every account, whatever its AI model setting, when it uses the channel.

Twilio

United States (San Francisco)

What it does: Phone numbers, call routing and transfers to the business’s staff, and SMS and WhatsApp delivery; texting registration with US carriers. WhatsApp messages also pass through Meta’s WhatsApp Business service.
Data it receives: Callers’ and staff phone numbers; call times, durations and status; call audio in transit (Amfion does not record calls); text and WhatsApp messages in both directions, including photos and files; delivery status and opt-out keywords. For texting registration, the business’s legal name, address, tax id and authorized representative.
Where it processes: Primary processing in the United States.
When: When the business uses a phone number or texting. Meta only when the business’s WhatsApp sender is approved.
AI model setting: Every account, whatever its AI model setting

Resend

What it does: Sends email (booking confirmations, verification codes, reminders, replies and notices to the business) and receives email sent to a business’s Amfion address.
Data it receives: Names, email addresses, appointment details and message text; inbound email with its attachments. For a law firm, notices to the firm leave out a person’s own words until a lawyer at the firm clears the names they gave.
Where it processes: Stores data in the United States.
AI model setting: Every account, whatever its AI model setting

Hosting and infrastructure

Every account. The database, the servers and the backups are all in Germany.

Supabase

Supabase Pte. Ltd. (Singapore)

What it does: The database, file storage, the credential vault and business users’ sign-in.
Data it receives: Everything Amfion stores: conversations and call transcripts, messages, inquiries, bookings and contacts, the business’s settings and knowledge, files shared in conversations, credentials a business connects (in the vault), and business users’ sign-in details.
Where it processes: Germany (the AWS Frankfurt region).
AI model setting: Every account, whatever its AI model setting

Hetzner

Germany (Gunzenhausen)

What it does: The servers that run Amfion, the server cache, the load balancer and the encrypted backups.
Data it receives: Every request Amfion handles, while it is handled; short-lived working copies in the cache (sessions, queued jobs); hourly database backups, encrypted before upload and kept up to 12 weeks.
Where it processes: Germany.
AI model setting: Every account, whatever its AI model setting

Cloudflare

United States (San Francisco)

What it does: DNS, DDoS protection, delivery of amfionhq.com and of the pages Amfion hosts for businesses, and optional bot checks (Turnstile).
Data it receives: Page requests to amfionhq.com and to business pages on it, with visitors’ IP addresses and the address of any appointment link opened; bot checks when enabled. Chat messages, texts, email and call webhooks go to Amfion’s servers directly, not through Cloudflare.
Where it processes: Cloudflare’s global network; Cloudflare says it stores customer data primarily in the United States and the EEA.
AI model setting: Every account, whatever its AI model setting

Payments

Card details go only to Stripe. No conversation content goes to Stripe.

Stripe

Stripe, LLC (United States)

What it does: Amfion’s billing of each business, and deposit checkout on the business’s own Stripe account for a business that asks for deposits. Deposits are never taken on a law firm account.
Data it receives: The business’s billing contact, plan and subscription. For a deposit, the payer’s email address, the service and the amount; Amfion receives the payment status, never card details.
Where it processes: United States.
AI model setting: Every account, whatever its AI model setting

Services a business chooses to connect or display

Used only for the businesses that turn them on, or on the pages Amfion hosts for a business.

Cal.com

What it does: Scheduling, for a business that books through its own Cal.com account instead of Amfion’s scheduler.
Data it receives: The customer’s name, email, phone number (if given) and appointment details.
Where it processes: Where the business’s Cal.com account keeps its data.
When: Only for a business that schedules through Cal.com.
AI model setting: Every account, whatever its AI model setting

Google

What it does: Calendar sync for a business that connects Google Calendar: busy times, and a copy of each booking. And the typeface on pages Amfion hosts at a business’s Amfion address, which visitors’ browsers load from Google Fonts.
Data it receives: Calendar sync: the appointment time and service and the customer’s name and email. Fonts: visitors’ IP addresses and browser details (the chat widget does not load them).
Where it processes: Google’s services.
When: Calendar sync only if the business connects Google Calendar; fonts on hosted pages.
AI model setting: Every account, whatever its AI model setting

Providers that receive no customer data

These work for Amfion but receive no personal data of the people who contact a business.

Jina AI (Reader)

Jina AI GmbH (Berlin, Germany), now part of Elastic N.V.

What it does: Fetches public pages of a business’s website that need a browser to display, when the website is read.
Data it receives: The address of a public page; Jina fetches it and returns its public text. No conversation, contact or intake data.
Where it processes: Not stated by the provider.
AI model setting: Every account, whatever its AI model setting

Google Places

What it does: Builds a preview from a business’s Google Maps listing instead of its website.
Data it receives: The search text or listing link someone enters; Google returns the business’s public listing. No conversation data.
Where it processes: Google’s services.
When: Previews only, before a business has an account.
AI model setting: Not part of any business’s AI model setting

Google Analytics

What it does: Measures visits to Amfion’s own website and sign-up pages.
Data it receives: Page addresses and events on amfionhq.com. It never loads on a business’s pages, in the chat widget or in the appointment portal, and never for visitors from the EU, EEA, UK or Switzerland.
Where it processes: Google’s services.
AI model setting: Not part of any business’s AI model setting

GitHub, Healthchecks.io and UptimeRobot

What it does: Amfion’s source code and build pipeline (GitHub), and uptime and backup heartbeat monitoring.
Data it receives: None: code, build logs and health checks only.
Where it processes: No customer data is sent to them.
AI model setting: Not part of any business’s AI model setting

Changes

How this list changes.

Before a new subprocessor first handles an existing business’s End Customer personal data (the data of the people who contact that business), Amfion emails the business’s account administrator at least 30 calendar days in advance, as section 9 of the Terms for Amfion business accounts promises.

The notice names the provider, what it will do, the data involved, the expected processing location, the planned start date, and how to raise a concern.
Amfion does not send that business’s End Customer personal data to the new provider during the notice period.
This page is updated before the new provider is used, and its date above changes with every edit.

Questions about a provider on this list: admin@amfionhq.com.

Subprocessors

Which AI model setting uses which provider.

AI model providers

Phone, texting and email

Hosting and infrastructure

Payments

Services a business chooses to connect or display

Providers that receive no customer data

How this list changes.

See your front deskbefore you sign up.

See your front desk
before you sign up.