Service Providers
Last updated: 9 June 2026
These are the third-party providers (sub-processors) we use to run the Sasha service. Personal data is stored at rest within the EU/EEA. Some processing in transit is carried out by providers located in the United States; those transfers are made under the EU Standard Contractual Clauses (and, where applicable, the EU–US Data Privacy Framework) with supplementary measures.
| Provider | Purpose | Region | Transfer basis |
|---|---|---|---|
| Neon | Database (data at rest) | EU (Frankfurt) | Within EU/EEA |
| Fly.io | Application hosting | EU (Frankfurt) | SCCs |
| Daily | Real-time call transport | EU (Frankfurt) | SCCs |
| Deepgram | Speech-to-text | EU | SCCs |
| Cartesia | Text-to-speech | United States | SCCs |
| ElevenLabs | Speech (fallback) | United States | SCCs |
| Google Cloud (Vertex AI) | Language model (when used) | EU | SCCs |
| OpenAI | Language model (when used) | United States | SCCs |
| Anthropic | Language model (when used) | United States | SCCs |
| Mistral | Language model | EU (Paris) | Within EU/EEA |
| WorkOS | Recruiter authentication | United States | SCCs / EU–US DPF |
| Resend | Invite emails | United States | SCCs |
| PostHog | Product analytics | EU | Within EU/EEA |
| Logfire | Operational telemetry (interview content excluded) | EU / US | SCCs |
| Cloudflare Turnstile | Bot protection on forms | Global | SCCs |
Notes
- The language-model provider depends on the configured model; providers marked “when used” process data only when that model is selected.
- Our language-model providers process data via their APIs and do not train on it.
- Raw call audio is not retained after the call ends.
We may add or replace providers. Customers are informed of intended changes and may object on reasonable grounds. Questions: privacy@sasharec.ai. See also our privacy policy.