We use sub-processors only to provide, secure, support, and improve Concya services.
Legal
Sub-processors
The service providers Concya uses to host, secure, route, transcribe, synthesize, analyze, and support the hospitality operating platform.
Last updated: May 21, 2026
How we use sub-processors
Providers act only to deliver Concya.
Sub-processors support specific products, channels, and integrations — never the whole platform at once.
Feature-specific providers apply only when the related product, channel, or integration is enabled.
Customer data is not sold, and providers are expected to process data only under Concya instructions.
Providers
The sub-processors Concya relies on.
Feature-specific providers apply only when the related product, channel, or integration is enabled.
Vercel
- Purpose
- Website hosting, edge delivery, serverless runtime, deployment logs
- Data categories
- Account, usage, request, and technical data
- Processing location
- United States
Supabase
- Purpose
- Database, authentication, storage, and backend APIs
- Data categories
- Account, venue, reservation, message, and configuration data
- Processing location
- United States / customer-selected region
Amazon Web Services
- Purpose
- Cloud infrastructure, compute, storage, and operational logging
- Data categories
- Application, voice, file, request, and technical data
- Processing location
- United States
Deepgram
- Purpose
- Speech-to-text transcription for voice experiences
- Data categories
- Audio, transcripts, call metadata
- Processing location
- United States
Cartesia
- Purpose
- Text-to-speech synthesis for voice experiences
- Data categories
- Generated response text and voice-session metadata
- Processing location
- United States
OpenAI, Groq, Ollama Cloud, Cerebras, NVIDIA NIM
- Purpose
- AI model inference for chat, menu analysis, operator tools, and voice workflows
- Data categories
- Prompts, context, transcripts, menu data, and user-provided content
- Processing location
- United States
Twilio and Telnyx
- Purpose
- Telephony, SMS, webhook routing, and phone-number services
- Data categories
- Phone numbers, call metadata, SMS content, voice routing data
- Processing location
- United States
Resend
- Purpose
- Transactional email delivery
- Data categories
- Email addresses, message content, delivery metadata
- Processing location
- United States
Stripe
- Purpose
- Payments, subscriptions, invoices, and connected-account wallet features
- Data categories
- Billing, payment, business, payout, and subscription data
- Processing location
- United States
PostHog and Vercel Analytics
- Purpose
- Product analytics, observability, performance, and event measurement
- Data categories
- Usage events, device data, page views, and performance metadata
- Processing location
- United States
Google, Square, Clover, Meta, and Composio
- Purpose
- Optional connected integrations for places, point-of-sale sync, WhatsApp, Instagram, email, and operator workflows
- Data categories
- Connected-account data, integration metadata, messages, menu, order, and business data
- Processing location
- United States / provider region
Updates
We keep this list current as the stack changes.
Concya may update this page when we add, replace, or remove material sub-processors. Enterprise customers with a signed data processing agreement should follow the notice terms in that agreement.
Questions about this list or our privacy practices can be sent to privacy@concya.com. For the broader description of how Concya collects, uses, shares, and retains data, see our Privacy Policy.
Have a question about our stack?
Our team can walk you through the architecture, share the DPA, and answer vendor questionnaires for your security review.