Sub-processor List

Whisperit SA

Prilly, Switzerland

Last updated: February 2026

---

Overview

Whisperit SA ("Whisperit") engages the third-party sub-processors listed below in the provision of its services. This page is maintained in accordance with the Data Processing Agreements (DPA-CH and DPA-EU) and the General Terms and Conditions of Whisperit SA.

Sub-processors are organised into three categories:

1. Data Hosting & Infrastructure — providers that host or store client data on a persistent or transient basis.
2. AI Processing — providers that process client data through AI models. Processing is transient (no data is retained beyond the session). All AI providers are contractually prohibited from using client data for model training.
3. Operational & Monitoring — providers used for debugging, error monitoring, email delivery, and analytics. These services do not process privileged client document content, except where expressly noted.

Whisperit offers three configurable data residency tiers — Swiss Only, EU, and Global — which determine which sub-processors are involved for a given client tenant. The tier is specified in the client's contract and can be changed upon request.

For questions or to request the deactivation of a specific sub-processor for your tenant, contact: privacy@whisperit.ai

---

1. Data Hosting & Infrastructure

These providers host persistent client data (documents, conversations, transcripts, user records) and operate the core platform infrastructure. Client content data is stored exclusively in Switzerland across all tiers.

Key guarantees:

• All persistent client data is stored exclusively in Switzerland, regardless of the client's tier.
• Backups and replicas remain within Switzerland.
• Both providers operate ISO 27001 / SOC 2 Type II certified data centres.

---

2. AI Processing

These providers process client data through large language models (LLMs) or AI services. Processing is transient: no data is retained by the provider beyond the duration of the API call. All AI providers are bound by enterprise-level agreements that contractually prohibit the use of client data for model training, fine-tuning, or improvement.

Key guarantees:

• No model training: All AI providers contractually guarantee that client data is not used for model training, fine-tuning, or improvement.
• No data retention: Data is not retained by AI providers beyond the duration of the API call.
• Tier isolation: Swiss Only tier clients' prompts and responses do not leave Switzerland (except for opt-in features: audio transcription via Sweden and Deep Research via USA).
• Deep Research: Only the user's research query is transmitted to OpenAI. No client documents or their contents are sent. Use is opt-in and at the client's discretion.
• Fallback behaviour: Swiss Only and EU tiers have no automatic fallback to alternative jurisdictions. If the primary provider is unavailable, requests fail gracefully.

---

3. Operational & Monitoring

These providers support platform operations: error monitoring, LLM debugging, transactional email delivery, and product analytics. Unless otherwise noted below, these services do not process privileged client document content.

¹ LangSmith processes LLM prompts and responses, which may include document context submitted to the AI assistant. LangSmith is used exclusively for debugging and quality assurance. It is configurable per tenant: Swiss Only clients may request its deactivation by written notice to privacy@whisperit.ai. Disabling LangSmith reduces Whisperit's ability to diagnose AI-related issues for the tenant. Retention: 14 days.

Key guarantees:

• Sentry, Loops, and Mixpanel process only operational metadata. They have no access to client documents, conversations, or privileged content.
• Swiss clients subject to professional secrecy may request the deactivation of any operational service involving non-Swiss processing.

---

4. Optional Sub-processors (Deactivated by Default)

The following sub-processors are available on request but are not activated unless explicitly enabled for a client's tenant.

---

Log Retention Schedule

For transparency, the retention periods for data held by operational sub-processors are as follows:

---

Data Residency Summary by Tier

---

Cross-Border Transfer Safeguards

Where data is processed outside Switzerland or the EU/EEA, the following safeguards apply:

• EU/EEA: Switzerland recognises EU Member States as providing adequate data protection (Federal Council adequacy list). Microsoft Azure operates within the EU Data Boundary for all EU/EFTA regions.
• United States: Standard Contractual Clauses (SCCs) as approved by the European Commission (Implementing Decision 2021/914) and recognised by the FDPIC. Data Processing Agreements (DPAs) with each US-based sub-processor. Where applicable, the Swiss-U.S. Data Privacy Framework provides additional safeguards.

---

Notification of Changes

Whisperit notifies clients at least 30 days in advance of any addition, replacement, or removal of a sub-processor, in accordance with the applicable DPA. Clients may object within 15 business days of notification. If no resolution is reached, the client may terminate the affected part of the contract without charge.

---

Contact

---

Whisperit SA — Prilly, Switzerland