Grovity uses the following third-party subprocessors to provide the Services. Each subprocessor is bound by written confidentiality, security, and data-protection obligations, and has committed that Client Content is not used to train its general-purpose models.
Core subprocessors
| Subprocessor | Purpose | Data processed | Location | Certifications |
|---|---|---|---|---|
| Amazon Web Services, Inc. | Cloud infrastructure, storage, queues, identity, key management, monitoring, and AI model access (Amazon Bedrock) | All Client Content | United States (us-east-1) | ISO/IEC 27001, 27017, 27018 · SOC 1, 2, 3 · PCI DSS Level 1 |
| MongoDB, Inc. (MongoDB Atlas) | Managed database | Conversations, configuration, and account data | United States (on AWS) | ISO/IEC 27001 · SOC 2 Type II · PCI DSS |
| Functional Software, Inc. (Sentry) | Application error tracking | Technical error data, with personal data masked | United States | SOC 2 Type II |
AI model providers (according to the Client's configuration)
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| OpenAI, L.L.C. | Language models, transcription | Conversation context required for each task | United States |
| Anthropic, PBC | Language models | Conversation context required for each task | United States |
| Google LLC | Language models | Conversation context required for each task | United States |
| ElevenLabs Inc. | Text-to-speech (only for agents with voice enabled) | Text of agent responses | United States |
When the same model families are used through Amazon Bedrock, processing takes place within Grovity's AWS environment and is covered by the AWS entry above.
Providers selected by the Client
Messaging platforms, telephony carriers, omnichannel tools, CRMs, and payment processors that the Client selects and connects to the Services (for example, Meta/WhatsApp, Respond.io, Botmaker, or Freshworks) are not Grovity subprocessors: they act under their own agreements with the Client or the end user.
Changes to this list
Grovity will publish any new subprocessor on this page at least thirty (30) days before it begins processing Client personal data, except in an emergency affecting the continuity or security of the Services. Clients that have signed the Data Processing Addendum can subscribe to notifications of changes by writing to privacy@grovity.ai, and may object to a new subprocessor on reasonable data-protection grounds as set out in the DPA.