In plain terms
These are the kinds of providers that handle data on our behalf, what each one does for us, what it receives, and where. Some serve everyone. Others are used only if you turn a feature on, such as phone, the meeting notetaker or e-signature. We name every provider to customers on request. This list is part of our Data Processing Addendum.
Used for everyone
| Provider type | What it does for us | Data it handles | Where |
|---|---|---|---|
| Database, sign-in and file storage provider | Database, sign-in, file storage and scheduled jobs | All account data and Customer Data | United States |
| Application hosting provider | Runs the application servers | Requests in memory and service logs | United States |
| Website and network provider | Hosts and delivers our website, DNS, and private file storage for downloads | Website visitor requests and the files we host | Global network, United States company |
| Transactional email provider | Sends sign-in, invitation, billing, notification and form emails for us | Recipient addresses and message content | United States |
| AI model provider (our default) | Chat answers, summaries, document reading, search indexing | The content needed for each AI task, such as the records and email text an answer uses | Provider's regions |
| Error monitoring provider | Error monitoring | Error details with user and organization IDs | United States |
| Rate limiting provider | Rate limiting, to stop abuse | IP address used as a counter key | Provider's regions |
| Payment and subscription billing provider | Subscription billing and tax | Organization and billing details, tax ID, plan, card brand and last four digits | United States |
Used when you turn a feature on
| Provider type | Feature | Data it handles |
|---|---|---|
| Telephony provider | Phone calls, numbers, call log, recordings and voicemail | Calls, phone numbers, recordings and voicemail |
| Meeting notetaker provider | Meeting notetaker | Meeting audio, video and transcripts. Video and audio removed after 60 days. |
| Speech provider | Voice notes, dictation and spoken replies | Audio and transcripts |
| Image, document, speech and notification provider | Reading images and documents, spoken output, and push notifications | Images, documents and text sent for that task; push title, body and device token |
| E-signature provider | Sending documents for signature | The document, signer names and emails, and signing events |
| Hosted browser providers | Hosted browsers for agents and automations, ours and a third party's | Pages and screenshots from the sites an agent visits |
| Web search and page-reading providers | Archie's web research | Search queries and the web addresses fetched |
| Business contact lookup provider | Looking up business contacts you ask about | A name and company domain |
| Video transcript provider | Reading a video link you give us | The link |
| Messaging connection provider | WhatsApp, Telegram, LinkedIn, Instagram and Messenger channels | Messages, contacts and attachments on the channels you connect, and posts you publish |
| Other AI model providers | Only if you bring your own key or AI client, or if we enable one for a feature | The content you send to it. Its terms apply. |
Services you connect yourself
When you connect one of these, you are telling Torchrunner to exchange data with it. They are not our subprocessors, and your agreement with each applies. The exchange is limited to what you authorize.
- Google Workspace: Gmail, Calendar, Drive and Contacts
- Microsoft: Outlook mail, calendar, contacts, OneDrive and SharePoint
- Intuit QuickBooks Online and Xero, for books, as each becomes available
- Stripe, and bank connections through Stripe, for your own invoicing and bank feed
- Slack, HubSpot and Notion
- An AI provider whose API key or client you connect
Small public lookups
A few features call public services with a small piece of data. Gravatar receives a one-way hash of an email address to show a profile picture. DuckDuckGo receives a sender’s domain to show a logo. Open-Meteo receives a location, only if you allow your browser to share it, for the weather on your home screen. Google Public DNS receives a company domain to check its mail setup.
Names, changes and notice
We name each provider to customers on request, in the list we attach to a signed Data Processing Addendum, and in our security documents. To ask for the named list, write to privacy@torchrunner.ai with “subprocessors” in the subject. We update this page before we start using a new provider type that handles Customer Data, and we email account owners who ask for notice before we add or replace a named provider. To object to a change, write to the same address. Objections are handled as our Data Processing Addendum describes.