Last Updated: November 30th, 2022
Third Party Sub-Processors
Twilio uses the third party companies below (each, a “sub-processor”) to process personal data (i) on behalf of Twilio customers; (ii) in accordance with customer instructions as communicated by Twilio; and (iii) in strict accordance with the terms of a written contract between Twilio and the sub-processor.
Twilio imposes obligations on its sub-processors to implement appropriate technical and organizational measures ensuring that the sub-processing of personal data is protected to the standards required by applicable data protection laws. Further information relating to sub-processor security measures can be found via the external links below.
Where the engagement of a sub-processor requires the cross-border transfer of personal data, Twilio has performed Transfer Impact Assessments for such data transfer.
Twilio maintains an up-to-date list of the names and locations of all sub-processors below. Twilio customers may subscribe to notifications of sub-processor changes to receive updates.
Duration of processing: For each sub-processor below, processing of personal data will be for the duration that the customer uses and continues to use the applicable service(s), and for the retention periods as set out in customer’s agreement with Twilio.
Sub-Processor | Applicable Service(s) | Subject matter | Nature and purpose of processing | Location(s) of processing | External links for additional information relating to security |
Adaptive Mobile | Programmable Messaging | Personal data contained in communications sent through the Twilio Services | Prevention of illegal or unwanted communications over Twilio’s messaging services | USA | |
AWS | All services | Personal data contained in communications sent through or uploaded to the services. | Infrastructure Provider providing hosting services and storage. | USA* | Compliance Program; GDPR Centre; Supplementary Measures Addendum; Blog |
AWS | Programmable Voice | Personal data contained in voice communications. | Text to speech functionality for customers using Amazon Polly. | USA | Compliance Program; GDPR Centre; Supplementary Measures Addendum; Blog |
AWS | Programmable Video | Personal data contained in streamed videos. | Streaming and interactive video. | USA* | Compliance Program; GDPR Centre; Supplementary Measures Addendum; Blog |
AWS | Marketing Campaigns (SendGrid) | Personal data contained in email communications. | Automation and storage services for marketing campaigns. | USA | Compliance Program; GDPR Centre; Supplementary Measures Addendum; Blog |
AWS | Email (SendGrid) | Personal data contained in email communications. | Routing and transmission of emails. | USA | Compliance Program; GDPR Centre; Supplementary Measures Addendum; Blog |
AWS | CDP (Segment) | Personal data contained in communications sent through the Segment Services | Infrastructure Provider providing hosting services and storage. | USA or EU (Dublin) as selected by customers | Compliance Program; GDPR Centre; Supplementary Measures Addendum; Blog |
Confluent | Twilio Flex | Personal data contained in communications sent through Twilio Flex. | Infrastructure management | USA | |
DVELP/Sabio | Twilio Flex | Personal data contained in voice communications. | Connectivity services to customer’s Google CCAI instance. | UK (provision of the services), Belgium, Finland, Germany, Netherlands, and Poland (data persistence/backups) | |
Datadog | Segment | System and event logs only | Operational monitoring | USA | |
GoodData Corporation | Twilio Flex | Personal data contained in communications sent through Twilio Flex. | Data analytics functionality for customers who have enabled the feature in Twilio Flex. | USA | |
Segment/Twilio Engage | Personal data contained in communications sent through the Segment Services | Data storage compute and queries | USA or EU (Zurich & London) as selected by Customers | ||
Programmable Voice; Twilio Flex | Personal data contained in voice communications. | Speech recognition functionality for customers who have enabled the feature on supported products. | USA | ||
IBM LLC. | Segment | Personal data contained in communications sent through the Segment Services | DB2 Data Warehouse Destination which customers can elect to transmit data to | USA or EU as selected by Customers | |
Meta | Whatsapp Channel | Phone numbers and message content | Message delivery for outbound/inbound | USA | |
Microsoft | Segment | Personal data contained in communications sent through the Segment Services | Azure, SQL, Data Warehouse Destination which customers can elect to transmit data to | USA or EU as slected by Customers | |
Snowflake | Marketing Campaigns (SendGrid) | Personal data contained in email communications. | Automation and storage services for Marketing Campaigns. | USA | |
Snowflake | Segment | Personal data contained in communications sent through the Segment Services | Snowflake Data Warehouse Destination which customers can elect to transmit data to | USA or EU as selected by Customers | |
VoiceBase | Programmable Voice; Twilio Flex | Personal data contained in voice communications. | Transcription services for customers who have enabled transcriptions on supported products. | USA |
* If using Regional Twilio for supported products, Customer Content is stored and processed in the region selected (Ireland or Australia). Exceptions will occur as necessary to investigate issues of fraud and abuse. At this time, all other data relating to your account and use of the Twilio Services will continue to be processed in the United States to allow Twilio to continue to provide and improve our Services to you.
Twilio Group Sub-Processors
Sub-Processor | Applicable Service(s) | Subject matter | Nature and purpose of processing | Location(s) of processing | External links for additional information relating to security |
Segment.io | EventStreams | Personal data contained in communications sent through the Twilio Services | Transmit event data as instructed by Twilio customers | USA | |
Segment.io | Segment Services | Segment.io acts as a processor for Twilio Inc. for the provision of the Segment Services | Provision of the Segment Services | USA | |
Twilio Inc. | All Services | If Twilio Inc. is not the Twilio party to the agreement, then Twilio Inc. is acting as a sub-processor for that Twilio party. (For example. If you are contracting with Twilio Ireland Ltd, then Twilio Inc. is acting as a sub-processor for the provision of the services. | Provision of the Twilio Services | USA* |
* If using Regional Twilio for supported products, Customer Content is stored and processed in the region selected (Ireland or Australia). Exceptions will occur as necessary to investigate issues of fraud and abuse. At this time, all other data relating to your account and use of the Twilio Services will continue to be processed in the United States to allow Twilio to continue to provide and improve our Services to you.