Security review

Data-flow map

Where call and audience data travels through Finn’s subprocessors — the data category each receives and its PHI/BAA status. Prepared for enterprise security reviews; mirrors Annex IV of our Data Processing Addendum.

Last updated: June 18, 2026

How region works.Data at rest — recordings, transcripts, and stored data — stays in the customer’s chosen workspace region (Iowa, Mumbai, Singapore, Sydney, London, or Frankfurt). Real-time processing (telephony, speech, and models) routes to each vendor’s endpoint appropriate to that region; these vendors operate globally, and some model-inference endpoints are US-based. Any transfer outside the workspace region is governed by the Standard Contractual Clauses in our DPA.

Live call pipeline

A single call flows top to bottom. Audio is processed in memory; only recordings and transcripts come to rest, in the customer-selected region. Finn Telephony, Finn STT, and Finn TTSare first-party services operated by Finn in the workspace region — not third-party subprocessors; the named vendors alongside them are. A given call’s exact flow depends on the workspace region and the voice and model stack configured for that agent — each call touches only the vendors in its configuration, and each hop below lists the full set a configuration can draw from.

Call ingress / egress

End caller (PSTN)

Inbound or outbound voice call over the public telephone network.

PHI:: —
Region:: Caller's network
Transfer risk:: HIGH

Telephony

Finn Telephony · Twilio · Plivo

Live PSTN voice payload, phone numbers, caller-ID. Not stored transcripts. Downstream carrier networks are mere conduits — not subprocessors.

PHI:: PHI — BAA in place ✓
Region:: United States · India (Plivo)
Transfer risk:: HIGH

Speech-to-text

Finn STT · Deepgram · Microsoft · Google

Raw inbound voice audio for real-time transcription. Not stored recordings.

PHI:: PHI — BAA in place ✓
Region:: US (Deepgram) · workspace region (Finn / Azure / Google)
Transfer risk:: HIGH

Language models

OpenAI (via Azure) · Claude & Gemini (via Google Vertex)

Transcript text + prompts, served via Microsoft Azure and Google Cloud — call data is not sent to OpenAI or Anthropic directly, under no-training model APIs with zero-data-retention configurations where offered and plan-enabled. OpenAI's realtime models (via Azure) additionally ingest raw audio; the other models receive transcript only.

PHI:: PHI — BAA in place ✓
Region:: United States, EU, or APAC depending on model and deployment; India for supported models. Realtime voice models always process globally.
Transfer risk:: HIGH

Text-to-speech

Finn TTS · ElevenLabs · Cartesia · Sarvam · Inworld · Smallest · Google · Microsoft

Text to synthesize (may contain PHI); returns generated audio. Does not receive inbound caller audio.

PHI:: PHI — BAA in place ✓
Region:: US / India · workspace region (Finn TTS)
Transfer risk:: MED

Storage & compute

Google Cloud · Microsoft Azure (interchangeable)

Voice recordings and transcripts at rest, in the customer-selected workspace region.

PHI:: PHI — BAA in place ✓
Region:: Iowa · Mumbai · Singapore · Sydney · London · Frankfurt
Transfer risk:: HIGH

Audience enrichment path

A separate flow, triggered only when a customer uploads an audience for enrichment. It does not touch the live call pipeline or any call content.

Audience enrichment (separate path — not the call pipeline)

ContactOut

Customer-uploaded contact identifiers; returns business email and LinkedIn data only. No PHI, and no voice or call content.

PHI:: No PHI — BAA in place ✓
Region:: United States
Transfer risk:: MED

Platform operations

Supporting services. None receive voice audio, transcripts, or PHI — all low transfer-risk.

Payments

Razorpay · Dodo · Lemon Squeezy

Customer billing identity + payment metadata. No call content.

Region: India (Razorpay) · Global (Dodo, Lemon Squeezy)

Transactional email

Resend

Recipient email + message content. No voice, transcripts, or PHI.

Region: US

Support

Intercom

Support-chat identity/content of customer users. No call recordings.

Region: US

Product analytics

PostHog

Product-usage events. No call content; pseudonymous usage identifiers, and account identifiers for signed-in users.

Region: US or EU (Frankfurt)

Error monitoring

Sentry

Error traces. No call content; may include account identifiers in error context.

Region: US

Security

Cloudflare

IP + request metadata (bot protection). No voice or transcripts.

Region: Global

Transfer basis.Where a subprocessor processes personal data outside the customer’s workspace region, the transfer is carried out under the Standard Contractual Clauses (Modules Two and Three) incorporated into our DPA, supported by technical measures (AES-256 at rest, TLS 1.2/1.3 in transit, ephemeral in-memory audio, and zero-data-retention model APIs where confirmed).

The full subprocessor register is at /subprocessors. All data-category and PHI/BAA entries above are engineering-confirmed as of June 18, 2026, and BAAs are in place with every PHI-touching subprocessor.