Data Processors

A data processor handles personal data on another party's instructions. The chart below is a public summary of our providers by category. Clause 6 of our Data Processing Addendum governs sub-processors, and we give their names on written request to [email protected].

Our servers are in the United States: call recordings, transcripts and account data sit in US regions, and the files you or your callers upload sit in AWS object storage in a US region. Cloudflare delivers and shields our websites, including this marketing site and the per-customer compliance sites and hosted forms on faedoc.com. Our listed language-model providers are US-headquartered but operate datacenters in more than one country and do not publish which one handled an individual request, so we do not claim a processing location for that step.

Primary data processors by category

Category	Provider	What they handle
Large language models	OpenRouter · routing Baseten · inference CoreWeave · inference DeepInfra · inference Fireworks AI · inference Ionstream · inference Novita AI · inference Parasail · inference Together AI · inference Venice AI · inference	The text your assistant reads and writes, plus AI-readable text from uploaded documents for which you turn on AI reading. For a scanned PDF with no text layer, the provider also receives page images for text recognition. Photos are never sent as images for that purpose. OpenRouter routes inference requests; the providers in our configured default list are Baseten, CoreWeave, DeepInfra, Fireworks AI, Ionstream, Novita AI, Parasail, Together AI and Venice AI, all US-headquartered. Before allowing covered processing, we must verify that the chosen route, written terms and settings meet the Data Processing Addendum, including its no-training and retention restrictions. Changes are subject to the advance notice and objection process below.This list describes the configured default provider set, not who served an individual request or confirmation that every account, endpoint, agreement and setting has been verified. One or more listed providers may never receive a request.
Speech to text	ElevenLabs American provider(s)	Speech turned into text.
Text to speech	ElevenLabs American provider(s)	Our text, spoken aloud.
Telephony	American provider(s)	Calls, text messages, and your provisioned phone numbers.
Email delivery	Amazon SES	The email we send to your account: service notices, sign-in links, report digests that contain call summaries, and per-call owner emails that may include the call transcript. Email limits a transcript to the first 20,000 characters; the complete transcript remains on the call record in your dashboard. Transactional mail only. We do not send email to your customers.
Marketing email	Resend	Your account email address and whether you asked us for product news. It holds that preference and nothing else, and only once you switch it on in your dashboard. It never receives caller data.
Business verification	TINCheck by Sovos	When our optional business-verification checks are enabled, your legal name, address and EIN are sent for IRS TIN matching, a federal watch-list (OFAC) screen, and a USPS address check. These checks are separate from carrier registration and approval. First AI Employee stores the EIN encrypted with AES-256-GCM only to file the 10DLC carrier registration, whether or not these checks run. We delete it when the registration is filed successfully or within 60 days after collection, whichever comes first, and backup copies roll off within a further 14 days. We keep the verification result when a check runs.
Servers and web services	Amazon Web Services Cloudflare	AWS runs our servers and our database in US regions. Files you or your callers upload sit in AWS object storage in a US region. Cloudflare provides DNS, security, and delivery for our websites.
Payments	Stripe	Subscription payments. Your card number goes to Stripe directly and is never stored on our systems.
Email and sign-in	Google	The support@ and billing@ mailboxes you write to, and the Google sign-in option for your account.
Integration and connectivity	Composio	Holds the connections you authorize from your dashboard. Calendar connections see the availability and appointment details needed for booking. Business-software connections receive only what the configured action needs, such as the caller name, phone number and call summary. During setup, Composio reads destination names and identifiers so you can choose and verify a spreadsheet, database, project, list or board. Before a managed write, it also makes a minimal duplicate check for First AI Employee's event marker in the selected sheet column, a matching Notion page title and marker block, or task and card names. Those reads are not used to import or synchronize the rest of your account. Composio does not receive call audio. It receives call data only when you have connected an integration that uses it, and only for calls sent to that integration. We chose Composio and we answer for it. Your Zapier account and the software where it writes are yours, not ours.
Mapping and routing	Google Maps Platform	Service addresses, to locate them and calculate travel times, when you use job routing.
Website analytics	Google Analytics	How the public site is used. Loads only if you accept analytics cookies, with ad personalization disabled.

What is not on this list

Integrations you connect are your accounts, not our processors: calendars, Slack, Microsoft Teams, Discord, Telegram, Signal, Google Chat, and the other destinations you choose for summaries and notifications. We send data there because you connected them, and you can disconnect them at any time. This page covers the systems that deliver the Service; it is not an inventory of every tool our company uses to run itself.

Changes

We update this page, or email Customers, at least ten days before a new sub-processor begins processing Customer personal data, as Clause 6 of our Data Processing Addendum provides. The version history below records each change.

Contact

This page works together with our Privacy Policy, our Terms of Service, and the Security page.

Version history

Every change to this page from August 20, 2026 onward, newest first. We start the record on that date rather than reconstruct one, and there is no gap being hidden: the page was maintained before then, and this is where its changes are written down from now on.

October 27, 2026

Added Google Maps Platform for job routing. Aligned the sub-processor and change-notice text with version 2.0 of the Data Processing Addendum.

October 11, 2026 (revision 2)

Aligned vendor information, written-contract duties and advance notice and objection rights with DPA v1.7; distinguished the configured provider list from verified operational and contractual evidence.

October 11, 2026

Removed an outdated visitor-location restriction from the description of per-customer compliance sites and hosted forms on faedoc.com.

August 23, 2026

Clarified that language-model providers may receive AI-readable document text and page images from scanned PDFs that have no text layer.

August 20, 2026

Started this version history.