This is Drawn’s version-pinned, customer-citable list of every third-party service that processes customer data. It supplements our Privacy Policy §13 and is referenced in our Data Processing Agreement.
Sub-processors Drawn uses
Each sub-processor below has a contract with Drawn (or, where noted, with you directly) and processes customer data only on Drawn’s documented instructions or the customer’s own connected-system terms.
- Purpose
- Primary database + authentication. Stores customer data + auth sessions.
- Data categories
- Account data, knowledge facts, behavioural signals, encrypted connector credentials, audit logs.
- Location
- Sydney, Australia (ap-southeast-2)
- Transfer safeguards
- Data-at-rest encrypted by Supabase; AU region selected so customer data stays onshore. Drawn enforces row-level security on every customer-data table.
- Contract
- Supabase Terms of Service + Data Processing Agreement (available on request)
- Purpose
- AI model inference (Claude). Generates summaries, briefings, chat answers, extracted facts.
- Data categories
- Call transcripts, uploaded document content, chat messages, sampled connector rows. Returned outputs.
- Location
- United States (San Francisco, CA)
- Transfer safeguards
- Anthropic Commercial Terms (no training on API inputs by default). Drawn sends only the minimum text needed for each request. Caller phone numbers HMAC-hashed before transmission. Request body in transit only — Anthropic does not persistently store customer API content.
- Contract
- Anthropic Commercial Terms of Service
- Purpose
- Hosting + serverless compute + edge proxy for the Drawn dashboard.
- Data categories
- All Drawn HTTP requests pass through Vercel — including request bodies in transit to Supabase + Anthropic. Vercel does not persistently store customer content; short-lived (1-7d) request logs are retained for operational debugging.
- Location
- United States + global edge network (request bodies do not flow through edge caches for authenticated routes)
- Transfer safeguards
- Vercel Terms of Service. TLS 1.2+ on all routes. Request logs scrubbed of obvious PII before retention.
- Contract
- Vercel Terms of Service + Data Processing Agreement (available on request)
- Purpose
- Voice-AI provider — only when YOU connect your Retell account. Holds the audio + transcript; Drawn reads via Retell API.
- Data categories
- Inbound + outbound call audio, transcripts, caller phone numbers (raw), call outcome tags.
- Location
- United States + selected regions per Retell deployment
- Transfer safeguards
- Retell holds your call data under your direct contract with Retell. Drawn pulls call data via Retell's authenticated API; Drawn's copy is encrypted at rest in Supabase (AU).
- Contract
- Your direct contract with Retell AI
- Purpose
- Telephony (SIP trunk, phone numbers, SMS) — only when YOU connect your Twilio account.
- Data categories
- Phone metadata (caller number, call duration, status), SMS content (if enabled).
- Location
- United States + selected regions per Twilio deployment
- Transfer safeguards
- Twilio holds your phone data under your direct contract with Twilio. Drawn reads via Twilio's authenticated API.
- Contract
- Your direct contract with Twilio
Sub-processors Drawn does NOT use
Drawn does not engage analytics, advertising, or behavioural-tracking processors:
- Google Analytics, GA4, Tag Manager
- PostHog, Mixpanel, Amplitude, Heap, Segment
- Hotjar, FullStory, LogRocket session-replay
- Facebook / LinkedIn / Twitter / TikTok advertising pixels
- Vercel Analytics or Speed Insights
- Any third-party A/B-testing or feature-flag service
The only third-party content your browser loads while using Drawn is Google Fonts (Geist typeface) and call-recording audio from your voice provider’s CDN (e.g. Retell’s CloudFront) when you open a call detail panel. See Privacy Policy §12 for the full cookie + browser-storage inventory.
How changes are notified
We will notify all active customers at least 30 days before adding a new sub-processor that processes customer content. If you reasonably object to the new sub-processor on data-protection grounds, you may terminate your subscription before the change takes effect and receive a pro-rata refund of any pre-paid fees for the unused portion of the term.
This list is also versioned: bump the “Version” number at the top of this page when a sub-processor is added, replaced, or removed. Superseded versions are retained on request.
For customers connecting upstream systems (APP 3.6)
When you connect a third-party system (Retell, Twilio, a Supabase database) to Drawn, you are disclosing personal information about your customers to us and our sub-processors. You warrant that you have an APP 5-compliant collection notice in place authorising that onward disclosure, and you agree to update your own privacy policy to name Drawn and Anthropic as additional processors before activating the connector.
Suggested wording you can adapt for your own privacy policy:
“We use Drawn Mind Solutions Pty Ltd (an Australian AI-analytics provider) to analyse our business calls and operational data. Drawn may disclose call content and operational records to its AI sub-processor Anthropic PBC (United States) for inference. By engaging with us, you consent to that disclosure.”
Contact
Questions about sub-processors, DPA requests, or to subscribe to the change-notification list: privacy@drawn.com.au.