Subprocessor List

Orion AI Solutions Inc., a Delaware corporation located at 2810 N Church St #607813, Wilmington, DE 19802 ("Orion"), may use the providers below to process Customer Personal Data when Orion or Customer enables the applicable Service. No provider processes every category of data for every customer.

Subprocessors

| Provider | Purpose | Data categories | |---|---|---| | DigitalOcean | Cloud compute, managed database, object storage, backups, networking, registry | Customer Data, account data, communications metadata, files, logs | | Cloudflare | DNS, content delivery, web application protection, Pages, edge routing, agent websites | IP/device data, web requests, account and site content | | Twilio | Voice, SMS/MMS, telephone numbers, carrier registration and related communications | Telephone numbers, call/message metadata and content, recordings, registration data | | Telnyx | Voice, SMS/MMS, telephone numbers, carrier registration and related communications | Telephone numbers, call/message metadata and content, recordings, registration data | | ElevenLabs | Conversational AI, speech synthesis, voice-agent processing | Audio, prompts, transcripts, call metadata, configured agent data | | Deepgram | Speech recognition and transcription for supported workflows | Audio, transcripts, call metadata | | OpenAI | AI-assisted product functions where configured | Prompts, instructions, content, outputs, limited related metadata | | Anthropic | AI-assisted product functions where configured | Prompts, instructions, content, outputs, limited related metadata | | Stripe | Payments, subscriptions, invoicing, tax and fraud support | Account, billing, transaction, tax and limited payment data | | Twilio SendGrid | Transactional, support, and product email | Email addresses, message content, delivery and engagement metadata | | Resend | Email delivery for supported workflows | Email addresses, message content, delivery metadata | | Sentry | Application error monitoring and diagnostics | Error, device, request and diagnostic metadata; content only if included in an error event | | PostHog | Product and website analytics or session replay where enabled | Device, usage, event and masked interaction data | | Google | Calendar integration, analytics, advertising measurement, authentication or related customer-enabled services | Account identifiers, calendar data, web/advertising events, tokens and permissions as applicable | | Meta Platforms | Advertising account integration, lead delivery, conversion measurement and customer-enabled services | Account, lead, campaign, event, token and advertising data as applicable | | Microsoft | Calendar or identity integration where enabled | Account identifiers, calendar or identity data, tokens and permissions as applicable |

Customer-directed and optional services

Some providers process data only when Customer enables an integration or selects a channel. Telecommunications carriers, payment networks, advertising platforms, and customer-selected integrations may also act as independent controllers under their own terms. The final list must distinguish those roles and identify optional services.

Changes and objections

Orion will maintain this public list and archive prior versions. Orion will post a new Subprocessor at least thirty days before authorizing that provider to process Customer Personal Data, except for an emergency replacement reasonably necessary to maintain security, availability, or legal compliance. Customer may object on reasonable data-protection grounds within fifteen days after notice as described in the DPA.

Questions may be sent to privacy@orionaisolutions.ai. Legal notices must be sent to legal@orionaisolutions.ai and Orion AI Solutions Inc., 2810 N Church St #607813, Wilmington, DE 19802. Delaware law applies as stated in the Terms.