Sub-processors
This page lists the third-party sub-processors Boom Enterprise Inc. engages to deliver its services. We maintain this list in accordance with our Data Processing Agreements with customers and applicable data protection laws, including the GDPR.
Last updated: September 3, 2026
| Sub-processor | Country of location | Purpose of processing |
|---|---|---|
| OpenAI, L.L.C. | United States | AI model inference for the generation of conversation responses. OpenAI does not use API data to train its models and retains data for no more than 30 days per its Data Processing Addendum. |
| Anthropic PBC | United States | AI model inference for the generation and review of conversation responses. Anthropic does not use API data to train its models and retains data for no more than 30 days per its Data Processing Addendum. |
| Eleven Labs Inc. (ElevenLabs) | United States | Conversational voice AI for the platform's voice channel. Processes end user telephone numbers, display names, and live call audio in order to perform speech recognition, response generation, and speech synthesis, and returns call transcripts and summaries to Boom. |
| Amazon Web Services, Inc. | United States | Cloud infrastructure hosting for application services, compute, and storage of personal data at rest. |
| Google LLC (Google Cloud Platform) | United States | Cloud infrastructure hosting for application services and storage of personal data at rest. |
| Neon, Inc. | United States | Managed PostgreSQL database hosting for storage of personal data, including interview transcripts, respondent contact details, and application data. |
| Vercel, Inc. | United States | Frontend application hosting and content delivery for the Boom web dashboard. |
| Upstash, Inc. | United States | Durable workflow orchestration, message queueing, caching, and rate limiting for asynchronous processing of platform events. Inbound webhook payloads and workflow step results transit and are retained by Upstash for the duration of a run, including end user phone numbers, messaging profile names, and conversation and transcript content. |
| Inngest Inc | United States | Durable workflow orchestration for journey execution, per-conversation extraction, segment evaluation, and customer data source synchronization. Workflow events identify records by internal identifier rather than by contact details, but the inputs and outputs of each workflow step transit Inngest and are retained in its run history, including the conversation and transcript content the extraction workflow processes. |
| Clerk, Inc. | United States | Authentication and identity management for the Boom web dashboard, covering user accounts, organizations, and role membership. Processes Boom user account data (name, email address, profile image) only; end users of Boom's customers are not registered as Clerk identities. |
| Ably Realtime Ltd | United Kingdom | Realtime transport that delivers live updates to the Boom dashboard and to end user web chat sessions. Conversation events pass through Ably in transit, including end user contact identifiers and message content. |
| Helicone, Inc. | United States | LLM observability and logging of requests and responses exchanged with AI providers, for monitoring, debugging, and operational analytics. |
| Better Stack (BetterStack s.r.o.) | Czech Republic (European Union) | Application-level logging and monitoring of platform events and system activity. |
| PostHog, Inc. | United States | Product analytics and session replay for Boom's authenticated web application, used for product analytics and diagnosing customer-reported issues. Processes Boom user account data (name, email) and application usage telemetry. |
| Twilio Inc. | United States | Messaging infrastructure for delivery of conversation messages between Boom's platform and end users. |
| Meta Platforms, Inc. (WhatsApp Business API) | United States | Messaging infrastructure for delivery of conversation messages via WhatsApp. |
| Plus Five Five, Inc. (Resend) | United States | Outbound and transactional email delivery. Processes recipient email addresses, names, and message content, both for end user outreach sent from a customer's verified sending domain and for platform notifications sent to Boom account users. |
| Stripe, Inc. | United States | Payment processing and billing for Boom's business customers. Processes billing contact information only. |
| Google LLC (Google Workspace) | United States | Internal productivity tools (email, documents, calendar) used by Boom personnel. May incidentally process personal data when customers communicate with Boom via email. |
| Vanta Inc. | United States | Compliance automation platform that monitors Boom's internal systems for security and compliance purposes. Does not process customer personal data. |
OpenAI, L.L.C.
Country of location: United States
Purpose of processing: AI model inference for the generation of conversation responses. OpenAI does not use API data to train its models and retains data for no more than 30 days per its Data Processing Addendum.
Anthropic PBC
Country of location: United States
Purpose of processing: AI model inference for the generation and review of conversation responses. Anthropic does not use API data to train its models and retains data for no more than 30 days per its Data Processing Addendum.
Eleven Labs Inc. (ElevenLabs)
Country of location: United States
Purpose of processing: Conversational voice AI for the platform's voice channel. Processes end user telephone numbers, display names, and live call audio in order to perform speech recognition, response generation, and speech synthesis, and returns call transcripts and summaries to Boom.
Amazon Web Services, Inc.
Country of location: United States
Purpose of processing: Cloud infrastructure hosting for application services, compute, and storage of personal data at rest.
Google LLC (Google Cloud Platform)
Country of location: United States
Purpose of processing: Cloud infrastructure hosting for application services and storage of personal data at rest.
Neon, Inc.
Country of location: United States
Purpose of processing: Managed PostgreSQL database hosting for storage of personal data, including interview transcripts, respondent contact details, and application data.
Vercel, Inc.
Country of location: United States
Purpose of processing: Frontend application hosting and content delivery for the Boom web dashboard.
Upstash, Inc.
Country of location: United States
Purpose of processing: Durable workflow orchestration, message queueing, caching, and rate limiting for asynchronous processing of platform events. Inbound webhook payloads and workflow step results transit and are retained by Upstash for the duration of a run, including end user phone numbers, messaging profile names, and conversation and transcript content.
Inngest Inc
Country of location: United States
Purpose of processing: Durable workflow orchestration for journey execution, per-conversation extraction, segment evaluation, and customer data source synchronization. Workflow events identify records by internal identifier rather than by contact details, but the inputs and outputs of each workflow step transit Inngest and are retained in its run history, including the conversation and transcript content the extraction workflow processes.
Clerk, Inc.
Country of location: United States
Purpose of processing: Authentication and identity management for the Boom web dashboard, covering user accounts, organizations, and role membership. Processes Boom user account data (name, email address, profile image) only; end users of Boom's customers are not registered as Clerk identities.
Ably Realtime Ltd
Country of location: United Kingdom
Purpose of processing: Realtime transport that delivers live updates to the Boom dashboard and to end user web chat sessions. Conversation events pass through Ably in transit, including end user contact identifiers and message content.
Helicone, Inc.
Country of location: United States
Purpose of processing: LLM observability and logging of requests and responses exchanged with AI providers, for monitoring, debugging, and operational analytics.
Better Stack (BetterStack s.r.o.)
Country of location: Czech Republic (European Union)
Purpose of processing: Application-level logging and monitoring of platform events and system activity.
PostHog, Inc.
Country of location: United States
Purpose of processing: Product analytics and session replay for Boom's authenticated web application, used for product analytics and diagnosing customer-reported issues. Processes Boom user account data (name, email) and application usage telemetry.
Twilio Inc.
Country of location: United States
Purpose of processing: Messaging infrastructure for delivery of conversation messages between Boom's platform and end users.
Meta Platforms, Inc. (WhatsApp Business API)
Country of location: United States
Purpose of processing: Messaging infrastructure for delivery of conversation messages via WhatsApp.
Plus Five Five, Inc. (Resend)
Country of location: United States
Purpose of processing: Outbound and transactional email delivery. Processes recipient email addresses, names, and message content, both for end user outreach sent from a customer's verified sending domain and for platform notifications sent to Boom account users.
Stripe, Inc.
Country of location: United States
Purpose of processing: Payment processing and billing for Boom's business customers. Processes billing contact information only.
Google LLC (Google Workspace)
Country of location: United States
Purpose of processing: Internal productivity tools (email, documents, calendar) used by Boom personnel. May incidentally process personal data when customers communicate with Boom via email.
Vanta Inc.
Country of location: United States
Purpose of processing: Compliance automation platform that monitors Boom's internal systems for security and compliance purposes. Does not process customer personal data.
Changes to our sub-processors
Boom may engage new sub-processors or replace existing ones from time to time. We will provide notice of such changes to customers with whom we have an active Data Processing Agreement, in the timeframes specified in that agreement (typically at least 10 business days in advance). Customers can request to be notified of changes by contacting privacy@useboom.ai with the subject line 'Sub-processor Notifications'.
Questions
For questions about this list or our data protection practices, please contact privacy@useboom.ai with 'Privacy' in the subject line.