Legal & Trust
Echo Core Services and Sub-Processors
Echo relies on a small number of third-party providers to deliver calls, messaging, AI analysis, workflow orchestration, and support operations.
Applies to: All Echo implementations Effective: 10 December 2025 Noindex legal reference
Core infrastructure and platform services
| Provider | Role | Data types | Location |
|---|---|---|---|
| AWS | Cloud hosting, storage, DynamoDB | Core application data, worker identifiers, call metadata, transcripts, risk scores, configuration | ap-southeast-2 Sydney, Australia |
| Managed Redis syd1 | Short-term cache | Temporary worker identifiers and demo call data | Sydney |
| Inngest | Workflow orchestration | Workflow events, job metadata, pseudonymous IDs | Multi-region cloud |
| Google Workspace | Internal email and calendar | Customer admin contacts, meeting invites, support emails | Google global infrastructure |
| Vercel | Marketing site hosting and CI/CD | Web logs and static frontend delivery | Global edge network |
Worker interaction sub-processors
| Provider | Role | Data types | Notes |
|---|---|---|---|
| Twilio | Outbound calls | Phone numbers, call metadata, voice audio pass-through | Production Voice traffic pinned to AU1 Sydney for Australian calls. |
| Hume.ai | Empathic voice interface | Call audio, real-time streams, transcripts, interaction metadata | Configured so Echo data is not used to train foundation models. |
| Bland.ai | Alternative AI call orchestrator | Call audio, phone numbers, metadata, conversation content | Used only where explicitly enabled. |
| ClickSend | SMS reminders | Phone numbers and reminder content | Used for reminders, not core check-in content. |
| Calendly | Scheduling | Names, emails, phone numbers, meeting times | Optional scheduling channel. |
AI model and workflow providers
- OpenAI: summarisation, reporting, and call configuration via API only; API data excluded from model training.
- Anthropic: transcript analysis, report construction, and live-call logic via API only; API data excluded from model training.
- Tally: forms for sign-up and consent collection.
- Zapier: workflow automation between forms, Echo, SMS, and related systems.
- Slack: internal alerts and collaboration using limited, high-level data only.
Controls
- Multi-factor authentication is required for admin accounts.
- Access is limited to authorised Echo team members.
- Secrets are managed via environment variables and secure secret stores.
- Providers are reviewed for security, privacy, and necessity.
Changes
Echo may add, replace, or remove processors as the service evolves. Customers who require change notifications should contact privacy@echo-control.com or refer to their Data Processing Addendum.