Trust
Subprocessors
Last updated: 5 October 2026
To provide the service, Lera relies on the providers below, acting as processors or sub-processors under contract and confidentiality obligations. We do not sell personal data. Data at rest is hosted in the European Union; part of the voice processing runs via providers in the US with the safeguards required by the GDPR (standard contractual clauses). When a business turns call recording on, the audio is stored in the European Union, in a bucket separate from the backups.
Providers that process call data
They take part in the call-answering service Lera provides on behalf of each client business. Tools the business connects with its own account (for example Cal.com, or its own system through functions) are not Lera sub-processors: the business contracts and controls them.
Involved in every call
| Provider | Purpose | Location / transfer |
|---|---|---|
| Twilio | Telephony and numbers | EE. UU. (opciones UE) — SCC |
| LiveKit | Call infrastructure (runtime) | EE. UU. — SCC / DPF |
| Deepgram | Speech-to-text (STT), agent voice (TTS) if a Deepgram voice is chosen, and voice dictation in the panel | EE. UU. (residencia UE) — SCC |
| OpenAI | Agent language processing as a backup to Microsoft, for the other models and in fast mode; voice (TTS) and speech-to-speech model, if the agent uses them; and backup of the knowledge-base search index | EE. UU. (OpenAI Ireland) — SCC |
| Microsoft (Azure) | Agent language processing for the models Lera has deployed on Azure, knowledge-base search index and speech-to-text (STT) | EU (Microsoft EU Data Zone; resource in Sweden), counterparty Microsoft Ireland |
| Contabo | Application and database hosting, and daily server backup | Germany (EU) |
| Backblaze B2 | Encrypted backups and, if the business turns recording on, the call audio (separate bucket) | Amsterdam (EU) |
Only if the business chooses them for its agent or account
| Provider | Purpose | Location / transfer |
|---|---|---|
| AssemblyAI | Speech-to-text (STT) | EU (Dublin), US counterparty — SCC |
| Anthropic | Agent language processing (if the business picks a Claude model) and panel copilot, which can show transcripts | EE. UU. — SCC |
| Google (Gemini) | Speech-to-speech model and speech-to-text (STT), if the agent uses them | EE. UU. — SCC |
| ElevenLabs | Agent voice (TTS) if an ElevenLabs voice is chosen, cloned voices, and speech-to-text (STT) | EE. UU. — SCC / DPF |
| Cartesia | Agent voice (TTS), if a Cartesia voice is chosen | EE. UU. — SCC |
| Resend | Delivery of the emails the agent sends to callers, if the business sets it up | EE. UU. — SCC |
| Cloudflare (Turnstile) | Anti-abuse when someone asks to be called from the business’s website | EE. UU. — SCC / DPF |
Providers for Lera’s own service
They do not process client call data; they support the account, email or payments.
| Provider | Purpose | Location / transfer |
|---|---|---|
| Resend | Account email (transactional) | EE. UU. — SCC |
| Stripe | Payments and billing | US (EU entity) — SCC |
| Cloudflare Turnstile | Anti-abuse at signup | EE. UU. — SCC |
| Sign-in with Google, if chosen | EE. UU. — SCC / DPF | |
| Google (Workspace) | Backup delivery of the signup code and password reset | EE. UU. — SCC / DPF |
| Calendly | Demo booking from the website | EE. UU. — SCC / DPF |
Changes to the list
Before adding or replacing a sub-processor that handles call data, we email the administrators of every account at least 15 days in advance, stating the provider, its purpose, its location and the transfer safeguard. Within that period the client can object on justified data-protection grounds and, if there is no reasonable solution, leave without penalty (clause 5 of the Data Processing Agreement). For any question: hola@leracore.com.
See also the Privacy Notice and the Cookie Notice.