Sub-processors
Last updated 27 October 2026
These are the outside services AE One uses to run the platform, what each one receives, and where it processes it. Our main database and file storage, the servers that run the app and the voice server for the Voice Agent (AI receptionist) are in Sydney, Australia. Several providers below are based overseas, mostly in the United States. How we handle personal information is set out in our Privacy Policy.
Hosting and delivery
Used for every workspace.
| Provider | What for | Information | Where |
|---|---|---|---|
| Supabase | Database, sign-in and file storage | All workspace data: account and team details, contacts, messages, bookings, quotes and invoices, call transcripts, clinical records and uploaded files | Sydney, Australia |
| Vercel | Hosts the AE One web app and runs its server code | Everything the app handles passes through it; request logs | Server code runs in Sydney, Australia. Vercel is a US company and its content network serves pages worldwide |
| BinaryLane | Hosts AE One's voice server, which runs the Voice Agent's calls | Live call audio and conversation text while a call is in progress | Sydney, Australia |
| Cloudflare Turnstile | Checks a visitor isn't a bot, only on busy days on a public form, booking page or website chat | The visitor's IP address and browser signals Turnstile collects while the check runs; no form answers | Cloudflare is a US company and runs the check on its worldwide network |
| Resend | Sends email: sign-in and account emails, reminders, automations and campaigns | Recipient name and email address, message content, delivery, open and click events | United States |
Voice Agent (phone calls)
Used when a business turns on its Voice Agent, the AI receptionist.
| Provider | What for | Information | Where |
|---|---|---|---|
| Telnyx | Australian phone numbers, calls and SMS, including voicemail recording and the carrier's own fallback message | Phone numbers, call audio, SMS content and delivery status, voicemail recordings | United States company; calls and texts use Australian numbers |
| Deepgram | Speech-to-text and the receptionist's voice | The caller's speech, and the text of the receptionist's replies | Deepgram's Australian endpoint; Deepgram is a US company |
| OpenAI | The language model that runs the receptionist's conversation; backup speech-to-text if Deepgram fails during a call (not for health workspaces unless they opt in) | What the caller says (as text), the business's receptionist instructions, and details looked up during the call such as available times and the caller's name; as the backup, the caller's speech | United States |
| ElevenLabs | Backup voice for the receptionist if Deepgram's voice fails during a call (not for health workspaces unless they opt in) | The text of the receptionist's replies | United States |
AI features in the app
Used when a business uses an AI feature. Identifiers are removed from customer text before it is sent.
| Provider | What for | Information | Where |
|---|---|---|---|
| Anthropic | Call summaries, ticket triage and reply drafts, quote drafts, social post captions and course quiz questions; backup model for the receptionist if OpenAI fails during a call (not for health workspaces unless they opt in) | For the AI features: text with identifiers removed (names, phone numbers, emails, addresses, dates of birth, Medicare and similar numbers); health workspaces only if they opt in, and diagnoses and treatment details are not removed. As the receptionist's backup: the same conversation text OpenAI receives | United States |
Services a business chooses to connect
Used only for a workspace that connects its own account with the provider.
| Provider | What for | Information | Where |
|---|---|---|---|
| Stripe | AE One subscription billing, and card payments for businesses that connect their own Stripe account | Billing name and email, payment details (entered with Stripe, not stored by AE One), amounts, and order and customer references | United States and other countries where Stripe operates |
| Meta (Facebook, Instagram, WhatsApp) | Messenger, Instagram and WhatsApp messages, lead ads, ad management and social posts | Messages and sender IDs, lead form answers, ad and campaign data, post content; hashed email and phone for customer-list audiences (never for health workspaces) | United States and other countries |
| Google Calendar sync and Sign in with Google | Calendar list, free/busy times and the booking events AE One creates; name, email and profile picture at sign-in | United States and other countries | |
| Microsoft | Outlook calendar sync | Busy times and the booking events AE One creates (service name, customer first name, time) | Unconfirmed (Microsoft operates worldwide) |
| Xero | Accounting and payroll sync | Customer name and email, invoices and payments; employees and timesheets for payroll | Unconfirmed (Xero is a New Zealand company) |
| Cliniko | One-off import of a clinic's existing records into AE One | Read only: AE One fetches the clinic's patients and appointments from Cliniko using the clinic's own key. Nothing is sent to Cliniko | The clinic's Cliniko region (for example Australia) |
Alternative and legacy providers
Not used by default. Used only where AE One switches one on for a workspace, or for older phone numbers.
| Provider | What for | Information | Where |
|---|---|---|---|
| Cartesia | Alternative receptionist voice | The text of the receptionist's replies | United States |
| Microsoft Azure Speech | Alternative receptionist voice | The text of the receptionist's replies | Australia East |
| Twilio | Older phone numbers and voicemail set up before the move to Telnyx; optional caller verification codes | Phone numbers, call audio, voicemail recordings, verification codes | United States |
| Mobile Message | Sending outgoing text messages from the business's own number at a lower cost. Replies still arrive through Telnyx | Recipient phone numbers, the business's sending number, SMS content and delivery status | Australia |
Services a business sends data to itself
A business can also send its own data to places it chooses, such as a webhook address it sets up, or the analytics and advertising tags already on its own website. Those destinations are chosen and controlled by the business, not by AE One.
Changes
We update this page when we add or change a provider. Questions: privacy@aeone.au.