Merdial engages the third parties below to deliver the Service. Each is bound by a written contract to process personal data only on Merdial’s instructions, with protections no less strict than those in our Data Processing Agreement. Merdial remains fully liable to its customers for their performance.
Get told before the list changes
We give at least 30 days’ notice before a new sub-processor begins processing customer data. To subscribe to those notices, email team@merdial.com with the address that should receive them. Customers may object on reasonable data-protection grounds; see DPA §6.Infrastructure and platform
| Sub-processor | What it does | Data it touches | Location |
|---|---|---|---|
| Supabase | Primary database, authentication, file storage, realtime and serverless functions. The system of record. | All Customer Data; account identity; authentication and transactional email. | United States / European Union (per project region) |
| Vercel | Hosting, edge delivery and DNS for the web application and marketing site; and the AI Gateway that routes every AI model request to the providers below. | Request metadata and IP address. Through the AI Gateway only: redacted transcripts and task context, in transit to the AI model providers below. | United States, with global edge network |
| Cloudflare | DNS resolution used when verifying customer custom domains. | Hostnames only. No personal data. | United States, global |
Speech
| Sub-processor | What it does | Data it touches | Location |
|---|---|---|---|
| Deepgram | Real-time and post-call speech-to-text. | Call audio and the transcript returned from it. | United States |
| Soniox | Failover speech-to-text in the desktop app: takes over a call when Deepgram is not responding, or transcribes first for a workspace configured that way. | Call audio and the transcript returned from it. | United States (default processing region) |
AI model providers
| Sub-processor | What it does | Data it touches | Location |
|---|---|---|---|
| Fireworks AI, DeepInfra and Baseten | Host the language model, GLM 5.3 Flash (an open-weights model), reached through Vercel AI Gateway. It writes everything the product writes after a call: call scoring, summaries, playbooks and briefs. Requests go to these three hosts only, in that order. | Redacted transcripts and the configuration context a task needs. | United States |
| Anthropic | Hosts Claude Haiku 5.5, reached through Vercel AI Gateway. It is the live coach’s model during a call: the Help me now lines, automatic cards for new challenges, the reading of the moment and which part of a reply comes next. | Redacted live-transcript excerpts and the account context the line needs. | United States |
| Amazon Web Services (Amazon Bedrock) | The live coach’s failover host: serves Claude Haiku 5.5 when Anthropic does not answer in time, reached through Vercel AI Gateway with zero data retention. | Redacted live-transcript excerpts and the account context the line needs. | An AWS region chosen by Vercel AI Gateway; it cannot be pinned for this model |
| OpenAI | Embedding model only (text-embedding-3-small), reached through Vercel AI Gateway: turns short pieces of text into vectors so the live coach and playbook can find related lines. It writes no text. | Short redacted text: playbook lines, objection phrases, live-transcript snippets. | United States |
| TypeSafe AI | Evaluation model (Jev) for the live coach, reached through Vercel AI Gateway. It answers typed questions about the moment in a call with probabilities, and never writes prose. | Redacted live-transcript excerpts and the question being asked. | United States |
Where the model calls go, stated plainly
Every AI model request that carries customer data goes through Vercel AI Gateway to providers in the United States, with one exception: when Anthropic does not answer in time, the live coach’s failover on Amazon Bedrock runs with zero data retention in an AWS region the gateway chooses, because the model cannot be pinned to a region there. GLM 5.3 Flash is an open-weights model developed by Z.ai; Merdial runs it on the US hosts named above and never sends content to Z.ai itself. The providers receive redacted transcript text and the context a task needs — never call audio, credentials, contact databases or payment data.Before any transcript reaches a model provider, payment-card patterns are stripped by the redaction layer described in the Security Overview. The model hosts and OpenAI are engaged on no-training terms for the content we send them — none may use it to develop its own models. TypeSafe AI does not offer a zero-retention commitment, which is why the live coach sends it only short, redacted excerpts and never a whole call. Merdial does improve its own models on de-identified transcripts; what that means, and how to opt out, is in Privacy §5.
Business operations
| Sub-processor | What it does | Data it touches | Location |
|---|---|---|---|
| Polar Software, Inc. | Merchant of record. Takes payment, issues invoices, handles sales tax and refunds. | Billing contact, company details, payment instrument, transaction records. Card numbers never reach Merdial. | United States (Delaware) |
| ipify | Returns the device’s own public IP address at sign-in, so brute-force protection and IP blocking can work. | IP address. Nothing else, and no account identifier is sent with the lookup. | United States |
What is not on this list
There is no advertising network, no data broker, no session-replay vendor and no third-party analytics on the product surfaces. Transactional email is sent through Supabase rather than a separate email platform. If a vendor is not named above, it does not process customer personal data.
Questions
Sub-processor objections, region-pinning requests and vendor due-diligence packs: team@merdial.com. This list is current as of 6 September 2026.
Changes. 28 October 2026: added Anthropic (the live coach’s model, Claude Haiku 5.5, through Vercel AI Gateway); Amazon Bedrock now serves as its failover. 1 October 2026: added Soniox (speech-to-text failover in the desktop app) and TypeSafe AI through Vercel AI Gateway (the live coach’s evaluation model), and widened Vercel’s entry to cover the gateway.