Sub-processors
Effective November 16, 2026
This page lists the sub-processors that Virbe sp. z o.o. ("Virbe") engages to process personal data on behalf of its Customers under the Data Processing Agreement (https://virbe.ai/dpa) ("DPA"). It forms Annex III of the DPA. Capitalised terms have the meanings given in the Terms of Service and the DPA.
1. How to read this list
Which providers process your data depends on your configuration:
- Sub-processors (Sections 2 to 4) are engaged by Virbe. Virbe has a written data processing agreement with each of them and is responsible for them under the DPA.
- Third-Party Services (Section 5) are providers that you choose and connect with your own credentials, for example your own OpenAI or ElevenLabs account. They are not Virbe's sub-processors: they process data under your own contract with them, and Virbe only transmits data to them on your instruction.
- Customer-Hosted deployments (for example in your own Microsoft Azure subscription) run in your infrastructure. Hosting sub-processors in Section 2 are not used for them.
Each entry shows the processing location and, where data may leave the European Economic Area (EEA), the transfer safeguard: an adequacy decision of the European Commission, including the EU–US Data Privacy Framework (DPF), or the Standard Contractual Clauses (SCCs).
2. Hosting (Virbe-Hosted)
| Sub-processor | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| OVH SAS (OVHcloud), France | Hosting and storage of the Virbe Hub, conversation data, Knowledge Base and backups | European Union (the data centre country of your deployment is shown in the Order Form or provided on request) | Not applicable (EEA) |
Additional hosting providers (used only if you select a region they serve). When Virbe makes additional hosting regions available, the provider of the selected region processes your data in that region. These providers are not used for Customers who have not selected such a region.
| Sub-processor | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Amazon Web Services EMEA SARL, Luxembourg | Hosting in the selected AWS region | The region you select | EEA regions: not applicable; other regions: adequacy decision or SCCs |
| Microsoft Ireland Operations Limited, Ireland | Hosting in the selected Microsoft Azure region | The region you select | EEA regions: not applicable; other regions: adequacy decision or SCCs |
| Google Cloud EMEA Limited, Ireland | Hosting in the selected Google Cloud region | The region you select | EEA regions: not applicable; other regions: adequacy decision or SCCs |
3. Service operations
| Sub-processor | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Twilio Ireland Limited (SendGrid), Ireland, and Twilio Inc., USA | Delivery of e-mails sent by the Services (for example notifications and confirmation e-mails) | EU and USA | DPF; SCCs |
4. AI engines provided by Virbe
These sub-processors are used only when (a) your configuration uses an AI, speech-to-text (STT) or text-to-speech (TTS) engine provided by Virbe with Virbe's credentials (for example a pre-provisioned engine on a Virbe-Hosted plan), or (b) Virbe provides model access as an intermediary (proxy) under an Enterprise Agreement. In each case Virbe's contract with the provider excludes the use of your data to train the provider's models.
| Sub-processor | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Microsoft Ireland Operations Limited, Ireland | Azure OpenAI models, Azure AI Speech (STT/TTS), Azure AI Language (PII detection) | EU (EU Data Boundary, where available for the selected service) | Not applicable for EU processing; otherwise DPF or SCCs |
| OpenAI Ireland Limited, Ireland, and OpenAI, L.L.C., USA | Large language models | EU or USA, depending on the model and data residency option | DPF; SCCs |
| Anthropic (Anthropic, PBC, USA, and its Irish affiliate) | Large language models | USA, or other locations offered by the provider | DPF; SCCs |
| Google Cloud EMEA Limited, Ireland | Gemini models, Speech-to-Text and Text-to-Speech | EU or USA, depending on the service and region | DPF; SCCs |
| ElevenLabs (Eleven Labs Inc., USA, and its EU affiliate) | Text-to-speech and speech-to-text | USA and EU | DPF; SCCs |
The list of engines available on each plan is shown in the Dashboard. If you prefer that none of these sub-processors is used, connect your own provider accounts instead (Section 5).
5. Third-Party Services you may configure (not sub-processors)
The Services can connect to the following types of services using your own credentials or endpoints. You decide whether to use them and agree the terms with the provider directly; please review each provider's data processing terms, data residency options and model training policy before going live.
| Type | Examples |
|---|---|
| Large language models and conversational AI | OpenAI, Azure OpenAI, Anthropic, Google Gemini, OpenAI Assistants, Dify, Dialogflow ES/CX |
| Speech-to-text and text-to-speech, including custom or cloned voices | Google Cloud Speech, Azure AI Speech, ElevenLabs, NVIDIA Riva (self-hosted by you) |
| PII detection | Azure AI Language in your Azure subscription |
| Avatar technologies | Unreal Engine MetaHuman, Didimo, Ready Player Me |
| Your own systems | Webhooks, custom endpoints and APIs you configure |
6. Providers processing account and billing data (Virbe as controller)
For transparency: Virbe also uses providers to manage Customer accounts, payments and communication. Virbe is the controller of this data, as described in the Privacy Policy (https://virbe.ai/privacy). These providers do not process conversation data.
| Provider | Purpose | Location |
|---|---|---|
| Google Ireland Limited and Google LLC (Firebase Authentication) | Sign-in and authentication of Authorized Users | EU and USA (DPF; SCCs) |
| Stripe Payments Europe, Limited, Ireland | Payment processing and subscription billing (Stripe acts in part as an independent controller) | EU and USA (DPF; SCCs) |
| Chargebee | Subscription billing (being replaced by Stripe) | EU and USA (DPF; SCCs) |
| Microsoft Ireland Operations Limited | Azure Marketplace purchases and billing (Microsoft acts as an independent controller) | EU and USA (DPF; SCCs) |
| HubSpot Ireland Limited | Customer relationship management and business communication | EU (data hosted in the EU) |
| Twilio Ireland Limited (SendGrid) | Account and transactional e-mails | EU and USA (DPF; SCCs) |
7. Changes and notifications
Virbe informs Customers of any intended addition or replacement of a sub-processor at least 30 days in advance, as described in Section 7 of the DPA. To receive notifications at an additional address (for example, your privacy team), write to [email protected]. Objections can be sent to the same address within the notice period.
Further information about the processors engaged by these sub-processors, and copies of the relevant data protection terms, are available on request.