Subprocessors and where data flows

Solwees uses a small set of subprocessors to deliver the product. Each one is contracted under a signed Data Processing Agreement (DPA) that mirrors the GDPR Article 28 obligations we accept toward our own customers. The full list is published at trust.solwees.ai and updated on every change with 30-day notice.

Hosting and storage: Amazon Web Services (eu-central-1, Frankfurt) for compute, storage and database. Data does not leave the EU under default configuration. AWS is contracted with a Standard Contractual Clauses-based DPA. Encryption: AES-256 at rest, TLS 1.3 in transit.

Telephony and messaging: Twilio for inbound and outbound phone calls (PSTN voice path); Meta for WhatsApp Business API; Stripe for payments and deposits. Each has its own DPA and operates under its published security and privacy posture (Twilio SOC 2, Meta GDPR commitments, Stripe PCI DSS Level 1).

Language models: large-language-model providers process customer conversations for the natural-language understanding layer. Names of specific providers, the data they receive, retention policies and the opt-out provisions for each are listed in the live subprocessor table at trust.solwees.ai. Critically: none of our LLM subprocessors are permitted to use customer conversation data to train their models. Zero-training is enforced contractually and is the default in our service tier with each provider.