Resona
Resona is the leading AI-powered voice conversation platform that helps organizations run real conversations with hundreds of people and synthesize insights into clarity you can act on.
Sub-processor List — Resona Pulse & Studio
Updated: 9 July 2026
This list identifies the third-party sub-processors Resona engages to deliver the Pulse & Studio platform. For each sub-processor it states the function it supports, the categories of personal data shared with it, its location, and the safeguard applied to any transfer outside the EEA. It is grouped by functional area so it is clear which sub-processor supports which function, and what information each one receives.
All sub-processors are engaged under Data Processing Agreements (GDPR Article 28). For transfers outside the EEA, Standard Contractual Clauses (SCCs) and supplementary technical and organisational measures are in place. Resona prioritises EU-based providers wherever feasible.
| Sub-Processor | Location / Data Residency | Service & Function | Categories of Personal Data Shared | International Transfer & Safeguard |
|---|---|---|---|---|
| AI Voice Interview | ||||
| VAPI | US & EU | Orchestrates the live voice call: manages real-time audio, turn-taking and interruptions, and coordinates the speech, language and voice services. | Voice audio and the real-time transcript of responses. | Processed in the EU (EU cluster). SCCs as a supplementary safeguard (US-incorporated provider). |
| OpenAI | US | The conversational LLM that powers the live interview — interprets each response and generates the next question or reply in real time. | Interview responses (text). | EU → US transfer: SCCs + DPA with additional measures (encryption, access controls). |
| Deepgram | EU | Speech-to-text transcription of the live interview (invoked via VAPI, using Resona's own key). | Voice audio and the resulting transcript. | No international transfer (processed at Deepgram's EU endpoint); model-training opt-out enabled. |
| ElevenLabs | US | Text-to-speech: converts the AI agent's generated questions into voice (agent voice output). (Not sensitive: ElevenLabs only voices the agent's questions, so no participant audio or personal data is processed.) | Agent-generated speech only — no participant audio or personal data. | EU → US transfer: SCCs. Processes agent output only, not respondent personal data. |
| Analysis & Reporting | ||||
| Anthropic | US & EU | Language model for interview logic and response analysis. For EU processing it is accessed via Google's Gemini Enterprise Agent Platform, which is hosted in the EU. | Interview responses (text). | Processed in the EU (Google Gemini Enterprise Agent Platform, EU region). SCCs as a supplementary safeguard. |
| Google Cloud Platform | EU | Speech-to-text support and AI analysis / report generation on the Gemini Enterprise Agent Platform, hosted in the EU. | Voice audio and the resulting transcripts; response content. | No international transfer (data processed in the EU). |
| Voyage AI | US | Text embeddings and reranking of interview content to power semantic search and analysis. | Interview transcript / response text. | EU → US transfer: SCCs. Resona has opted out of Voyage AI's data-usage programme: inputs are not used for model training and are not retained (zero-day retention). |
| Data storage | ||||
| Supabase | EU | Primary database and user authentication — stores responses, transcripts and account data (EU region, AWS eu-west-3). | Respondent records, responses and transcripts; account name and email. | No international transfer (data stored in the EU). |
| Neo4j Aura | EU | Knowledge-graph database — stores the structured analysis derived from interviews (quotes, sections, themes), EU instance. | Interview verbatims and derived analysis. | No international transfer (EU instance). |
| Application hosting & delivery | ||||
| Scaleway | EU | Hosts the core backend application in the EU. | Platform data processed on the hosted services. | No international transfer (EU-only hosting). |
| Vercel | EU | Serves the web application (frontend) in the EU. | Front-end interactions; no stored interview data. | No international transfer (EU region selected). |
| Platform operations & supporting services | ||||
| GitHub | US | Stores source code and runs the deployment pipeline. | None — no personal data (incidental logs only). | EU → US transfer: SCCs + corporate certifications (ISO 27001, SOC 2). |
| Sentry | EU | Monitors application errors and performance. | Diagnostic logs (minimised; no interview content). | No international transfer (EU hosting enabled). |
| Resend | EU | Sends invitation, verification and notification emails. | Recipient name and email address. | No international transfer (EU region used). |
| Mixpanel | EU | Product usage analytics (EU ingestion). | Pseudonymous usage / event data (no interview content). | Ingested via an EU proxy. |
Changes to this list
Resona maintains this list as part of its GDPR Article 28 obligations. Clients are notified in advance of any addition or replacement of a sub-processor, in accordance with the applicable Data Processing Agreement, so that they may raise any objection.