Security and data protection
Sub-processors
Which kinds of company process data for your deployment on Telonic's behalf, what their contracts require, and how you are told about changes.
On this page
You decide why and how your customers' personal data is used, and Telonic processes it on your instructions. To run your deployment, Telonic uses a small number of specialist providers, such as the cloud provider that hosts it and the providers of the speech models and the language model (the AI model that understands the conversation and decides the reply). This page explains which kinds of provider are involved, where they process data, what their contracts require, and how you are told before anything changes.
What a sub-processor is
A sub-processor is a company that processes personal data on Telonic's behalf, so that Telonic can deliver the service to you. Each one is bound by a contract with Telonic that limits what it may do with your data. The list of sub-processors for your deployment is part of your data processing terms (the part of your agreement that sets out how Telonic handles personal data for you), and is available on request.
Your own suppliers are not Telonic's sub-processors. Your carrier, your email provider, your CRM (customer relationship management system) and any Meta business solution provider you already use work under your own contracts with them, as they do today.
Categories of sub-processor
| Category | What they do | Where they process your data |
|---|---|---|
| Cloud hosting | Provide the data centres, computing and storage your deployment runs on | In your chosen region. The provider and region are named in your agreement |
| Language model providers | Provide the model that understands the conversation and decides the reply | In your chosen region. Outside it only if you explicitly choose a provider outside it, with personal information redacted first |
| Speech providers | Provide speech recognition (turning speech into text), voice synthesis (speaking the reply), or both | Always in your chosen region |
| Messaging, if you use WhatsApp | Meta carries WhatsApp messages between your customers and your deployment | On Meta's own infrastructure, where Meta receives, processes and briefly stores messages under its own terms |
Which providers and models are available in your region is confirmed during implementation, and named in your agreement. The providers Telonic works with are listed on Models and providers.
In your own cloud account or on your own premises, every component runs inside your environment, so fewer providers process data on Telonic's behalf. Which, if any, apply to your deployment is set out in your agreement.
What every provider's contract requires
| Requirement | What it means for you |
|---|---|
| No training on your data | Contracts with every provider prohibit using your data to train or improve their models |
| Zero data retention wherever offered | Where a provider offers an arrangement not to keep inputs and outputs, Telonic uses it |
| Processing only for its role | A provider processes data only to perform its part of a conversation, such as transcribing speech or composing a reply |
| In-region processing | Providers process your data in your chosen region, except a language model outside it that you have explicitly chosen |
| Security and confidentiality | Each provider is bound to protect the data it processes, and to tell Telonic of any breach that affects it |
How you are told about changes
You receive 30 days' notice of any change to the sub-processors for your deployment, with the right to object. The notice names the provider, what it will do and where it will process data. If you object, we work with you on an alternative, such as a different approved provider in your region.
A change of provider for your deployment also goes through the same release process as any other change. It is tested against conversations drawn from your industry, and it is released only after you approve it.
In practice
Wadi Assurance, an insurer, hosts in the UAE region.
- Telonic identifies a speech recognition provider, deployed in the UAE, that handles Emirati Arabic better on claims calls.
- Wadi Assurance's data protection officer receives notice naming the provider, its role and where it processes data.
- The legal team reviews the provider's terms, including the prohibition on training and its zero data retention arrangement.
- Telonic tests the new provider against the insurer's claims conversations. The results are shared with the claims operations team.
- After the notice period, the insurer approves the change. It goes live, and the sub-processor list in its data processing terms is updated.
What your team controls
- Whether any language model outside your region may be used.
- Objecting to a new sub-processor within the notice period.
- Approval of any change of model or provider before it goes live.
- The named contacts who receive notices.
Related
- Models and providersAgents
- Hosting and data residencySecurity and data protection
- How data flows through a conversationSecurity and data protection
- Contracts and data processing termsLegal and compliance
- Data protection in the UAE and Saudi ArabiaLegal and compliance
Product names and logos are trademarks of their owners. Their mention shows systems Telonic connects to and does not imply partnership or endorsement.