Our sub-processors
PipeGuide uses a small number of trusted third-party services to deliver the product. Each is bound by a Data Processing Agreement (DPA) and is listed here for full transparency, as required by POPIA §21 and GDPR Article 28.
| Provider | Purpose & data processed | Region | DPA |
|---|---|---|---|
| Recall.ai | Meeting bot joining + native live transcription for Google Meet, Zoom, and Microsoft Teams calls. Meeting audio (transient), meeting transcripts, participant names visible in the meeting. | EU (Frankfurt) — eu-central-1 | View DPA |
| OpenAI | GPT-5.2 powers live qualification scoring, suggested questions, and post-call summaries. Transcript text (not audio). API requests opt out of training per OpenAI Enterprise terms. | United States — multi-region | View DPA |
| Deepgram | Speech-to-text for in-person / phone-call mode (browser microphone input only). Audio chunks streamed during a live call (not retained). | United States | View DPA |
| Paystack | Subscription billing, payment processing, invoice generation. Billing email, organisation name, payment method tokens (cards never touch our servers). | South Africa + Nigeria (PCI-DSS certified) | View DPA |
| Resend | Transactional email delivery (welcome, invites, weekly digests, billing receipts). Recipient email address, email content. | United States | View DPA |
| Google (OAuth) | Optional "Sign in with Google" authentication. Email, name, profile picture — only if the user chooses Google sign-in. | Multi-region | View DPA |
| MongoDB Atlas | Primary application database — call sessions, users, organisations, settings. All PipeGuide application data (transcripts, scores, frameworks, products, billing records). | AWS af-south-1 (Cape Town) — data residency for African customers | View DPA |
| Emergent (hosting platform) | Application hosting, deployment, log infrastructure. Server logs (no PII in logs by policy), encrypted application files. | Multi-region cloud | View DPA |
Changes to this list
We'll notify customers via email at least 30 days before adding any new sub-processor or making a material change to data flow. To object, email privacy@pipeguide.tech.
Last updated: 14 Feb 2026 · Questions? privacy@pipeguide.tech