The third parties Numi engages to deliver its sales call intelligence service. Each entry lists the legal entity, processing country, purpose, data categories, and the transfer safeguards in place. This list is incorporated by reference into the Numi Data Processing Agreement (Auftragsverarbeitungsvertrag, AVV) and the Privacy Policy.
These vendors process customer personal data as part of the Numi service itself, regardless of which integrations the customer has connected. They are bound by data processing agreements with Numi.
| Sub-processor | Legal entity | Country | Purpose | Data categories | Transfer safeguard / certification |
|---|---|---|---|---|---|
| Hetzner Cloud | Hetzner Online GmbH | DE (Frankfurt) | Hosting of application, PostgreSQL database, and MinIO object storage (audio recordings, exports). | All customer content data: account profile, call recordings, transcripts, coaching cards, practice sessions. | EU/EEA processing only. ISO 27001 certified. AV-Vertrag (DPA) in place per Art. 28 GDPR. |
| Cloudflare | Cloudflare, Inc. | US (EU edge) | DNS, CDN, TLS termination, and WAF for numigtm.com and the Numi application. | IP address, user-agent, request metadata. No audio, transcripts, or coaching content. | EU Standard Contractual Clauses (SCC). ISO 27001, SOC 2 Type II. EU data localisation enabled where supported. |
| Anthropic | Anthropic, PBC | US | Coaching model, Claude option. Generates coaching cards, scores, and live-coaching hints from transcripts. Numi's coaching model is customer-selectable; this transfer applies while a customer is on the Claude option. Numi is rolling out a self-hosted EU coaching model as the alternative (see "Self-hosted" below). | Call transcripts and practice transcripts (text). No audio. | EU SCC. Zero-retention API enrolment: prompts not used for model training, transient processing. |
| OpenAI | OpenAI Ireland Limited | IE / US | Embedding generation for transcript search and semantic features. | Transcript snippets (text only). | EU SCC via OpenAI Ireland Limited. Zero-retention API mode. Prompts not used for model training. |
| Loops.so | Loops Email, Inc. | US | Transactional email (sign-up confirmation, magic links, product updates) and waitlist forms. | Email address, first name, signup metadata. | EU SCC. SOC 2 Type II. Data minimisation: only contact data, no content data. |
| Postmark | ActiveCampaign, LLC (Postmark) | US | Transactional email transport for team invites and account notifications (fallback / alternative to Loops.so). | Email address, invite metadata. | EU SCC. SOC 2 Type II. |
| Sentry | Functional Software, Inc. (dba Sentry) | EU (Frankfurt region) | Backend error monitoring and exception aggregation. | Stack traces, request metadata, user ID. No audio, transcripts, or coaching content. | EU data residency (sentry.io EU). ISO 27001, SOC 2 Type II. PII scrubbing configured server-side. |
| PostHog Cloud | PostHog, Inc. | EU (eu.posthog.com) | Product analytics, session replay (masked), and frontend error capture. | Pseudonymised user ID, page/event metadata, masked DOM. No audio, transcripts, or coaching content. | EU data residency. SOC 2 Type II. Autocapture of inputs disabled; sensitive selectors masked. |
| Google Analytics | Google Ireland Limited | IE / US | Aggregated page-view analytics for the public marketing site (numigtm.com), not the Numi application. | Anonymised page views, referrer. IP anonymisation enabled. | EU SCC via Google Ireland. Data retention set to 14 months. Not active in the authenticated Numi app. |
| Cal.com | Cal.com, Inc. | EU hosting available | Meeting booking links for early-access calls (marketing site only). | Name, email, scheduling preference. No application data. | EU SCC. Open-source self-hostable; cal.com handles bookings only. |
The following processors only receive data when the customer explicitly connects them. They act under the customer's instructions and contractual relationship, not Numi's. Numi acts as conduit for data the customer chooses to ingest.
| Sub-processor | Legal entity | Country | Purpose | Data categories | Transfer safeguard / certification |
|---|---|---|---|---|---|
| HubSpot | HubSpot Ireland Limited | IE / US | CRM connector, customer-initiated. Numi reads call recordings and CRM context only when the customer connects HubSpot via OAuth. | Call recordings, contact metadata, deal stage (as exposed by the customer's HubSpot account). | EU SCC via HubSpot Ireland. ISO 27001, SOC 2 Type II. Customer governs scope via OAuth. |
| Fathom | Fathom Video, Inc. | US | Meeting-recording connector, customer-initiated. Numi fetches recordings and transcripts only after the customer connects Fathom via API key. | Meeting recordings, transcripts, participant metadata (as exposed by the customer's Fathom account). | EU SCC. SOC 2 Type II. Customer governs scope via API key. |
Whisper large-v3. Numi runs OpenAI's open-weight Whisper model on Numi's own Hetzner infrastructure in Frankfurt for speech-to-text transcription. Audio never leaves Numi's EU infrastructure. The OpenAI organisation listed above provides only the embedding API (text only); it does not receive Numi audio.
EU self-hosted coaching model (rolling out). Numi's coaching model is architected to be customer-selectable. Numi is rolling out a self-hosted, open-source coaching model running on Numi's own Hetzner infrastructure in Germany. On that option, transcript text stays inside Numi's EU infrastructure and no third-party LLM sub-processor receives it. Until a customer is moved to the self-hosted coaching model, coaching runs on the Anthropic (Claude) option listed above, under the Standard Contractual Clauses and zero-retention terms noted there. Only the processor for the coaching model a customer is on receives transcript text.
Content data (audio recordings, transcripts, AI-generated coaching) is processed strictly on behalf of the customer as data controller, governed by the Numi Data Processing Agreement (AVV). Content data is never used to train publicly accessible AI models.
Where personal data is transferred outside the EEA, transfers rely on appropriate safeguards under Art. 46 GDPR, in particular the EU Standard Contractual Clauses (SCC), complemented by technical and organisational measures (encryption in transit via TLS 1.2+, encryption at rest, pseudonymisation, role-based access controls, audit logging).
Change notification. Numi will notify customers at least 30 days before adding or replacing a sub-processor that processes content data. Customers may object on legitimate grounds; if the objection cannot be resolved, the customer may terminate the affected service per the AVV.
For questions or to subscribe to sub-processor change notifications, contact privacy@numigtm.com.