Data Processors

A data processor is a company that handles some of your data, or your callers’ data, on our instructions so the Service can run. The chart below lists the primary processors by category. It is deliberately not a directory of every vendor we hold an account with: operational categories name the category and the country rather than the company, because the vendor in one of those slots can change while the promise stays the same.

Our servers are in the United States: call recordings, transcripts and account data sit in US regions, and the files you or your callers upload sit in AWS object storage in a US region. Two nuances. Cloudflare delivers and shields our websites. This marketing site is open to visitors anywhere; the per-customer compliance sites and hosted forms on faedoc.com are still served only to visitors in the United States and Canada. And for the language-model step we use US-headquartered providers whose terms forbid training on your data, but those providers run datacenters in more than one country and none of them publishes which one handled an individual request, so we do not claim a processing location for that step.

Primary data processors by category

Category	Provider	What they handle
Large language models	OpenRouter · routing Baseten · inference CoreWeave · inference DeepInfra · inference Fireworks AI · inference Ionstream · inference Novita AI · inference Parasail · inference Together AI · inference Venice AI · inference	The text your assistant reads and writes, plus AI-readable text from uploaded documents for which you turn on AI reading. For a scanned PDF with no text layer, the provider also receives page images for text recognition. Photos are never sent as images for that purpose. OpenRouter routes each request to one provider from a closed list we set in code, all of them US-headquartered. The list is Baseten, CoreWeave, DeepInfra, Fireworks AI, Ionstream, Novita AI, Parasail, Together AI and Venice AI. Each one commits in its own terms not to train on what we send or to keep it beyond serving the request, and we send that restriction with every request. If we change the list we update this page and email your account.This is the set a request may reach, not a record of who served one. OpenRouter picks a single provider per request, and one or more of these may never receive a request at all. We name all nine because all nine are eligible in our code and in our OpenRouter account.
Speech to text	ElevenLabs American provider(s)	Speech turned into text.
Text to speech	ElevenLabs American provider(s)	Our text, spoken aloud.
Telephony	American provider(s)	Calls, text messages, and your provisioned phone numbers.
Email delivery	Amazon SES	The email we send to your account: service notices, sign-in links, report digests that contain call summaries, and per-call owner emails that may include the call transcript. Email limits a transcript to the first 20,000 characters; the complete transcript remains on the call record in your dashboard. Transactional mail only. We do not send email to your customers.
Marketing email	Resend	Your account email address and whether you asked us for product news. It holds that preference and nothing else, and only once you switch it on in your dashboard. It never receives caller data.
Business verification	TINCheck by Sovos	Your legal name, address and EIN, once, during business verification for texting: IRS TIN matching, a federal watch-list (OFAC) screen, and a USPS address check. After the check passes, First AI Employee stores the EIN encrypted with AES-256-GCM only to file the 10DLC carrier registration. We delete it when the registration is filed successfully or within 60 days after collection, whichever comes first. We keep the verification result.
Servers and web services	Amazon Web Services Cloudflare	AWS runs our servers and our database in US regions. Files you or your callers upload sit in AWS object storage in a US region. Cloudflare provides DNS, security, and delivery for our websites.
Payments	Stripe	Subscription payments. Your card number goes to Stripe directly and is never stored on our systems.
Email and sign-in	Google	The support@ and billing@ mailboxes you write to, and the Google sign-in option for your account.
Integration and connectivity	Composio	Holds the connections you authorize from your dashboard. Calendar connections see the availability and appointment details needed for booking. Business-software connections receive only what the configured action needs, such as the caller name, phone number and call summary. During setup, Composio reads destination names and identifiers so you can choose and verify a spreadsheet, database, project, list or board. Before a managed write, it also makes a minimal duplicate check for First AI Employee's event marker in the selected sheet column, a matching Notion page title and marker block, or task and card names. Those reads are not used to import or synchronize the rest of your account. Composio does not receive call audio. It receives call data only when you have connected an integration that uses it, and only for calls sent to that integration. We chose Composio and we answer for it. Your Zapier account and the software where it writes are yours, not ours.
Website analytics	Google Analytics	How the public site is used. Loads only if you accept analytics cookies, with ad personalization disabled.

What is not on this list

Integrations you connect are your accounts, not our processors: calendars, Slack, Microsoft Teams, Discord, Telegram, Signal, Google Chat, and the other destinations you choose for summaries and notifications. We send data there because you connected them, and you can disconnect them at any time. This page covers the systems that deliver the Service; it is not an inventory of every tool our company uses to run itself.

Changes

We update this page when the list changes, and the date above is the version marker. Every change from August 20, 2026 onward is listed at the bottom of this page. If a category label here ever stops being true, that is a bug in the page, not a footnote: tell us and we will correct it.

Contact

This page works together with our Privacy Policy, our Terms of Service, and the Security page.

Version history

Every change to this page from August 20, 2026 onward, newest first. We start the record on that date rather than reconstruct one, and there is no gap being hidden: the page was maintained before then, and this is where its changes are written down from now on.

August 23, 2026

Clarified that language-model providers may receive AI-readable document text and page images from scanned PDFs that have no text layer.

August 20, 2026

Started this version history.