Twilio Sub-Processors

Last Updated: April 4, 2022

Third Party Sub-Processors

Twilio uses the third party companies below (each, a “sub-processor”) to process personal data (i) on behalf of Twilio customers; (ii) in accordance with customer instructions as communicated by Twilio; and (iii) in strict accordance with the terms of a written contract between Twilio and the sub-processor.

Twilio imposes obligations on its sub-processors to implement appropriate technical and organizational measures ensuring that the sub-processing of personal data is protected to the standards required by applicable data protection laws. Further information relating to sub-processor security measures can be found via the external links below.

Where the engagement of a sub-processor requires the cross-border transfer of personal data, Twilio has performed Transfer Impact Assessments for such data transfer.

Twilio maintains an up-to-date list of the names and locations of all sub-processors below. Twilio customers may subscribe to notifications of sub-processor changes to receive updates.

Duration of processing: For each sub-processor below, processing of personal data will be for the duration that the customer uses and continues to use the applicable service(s), and for the retention periods as set out in customer’s agreement with Twilio.

Sub-Processor	Applicable Service(s)	Subject matter	Nature and purpose of processing	Location(s) of processing	External links for additional information relating to security
Adaptive Mobile	Programmable Messaging	Personal data contained in communications sent through the Twilio Services	Prevention of illegal or unwanted communications over Twilio’s messaging services	USA	Data Privacy
Appen Butler Hill	Twilio AI	Personal data contained in voice communications.	Human annotation of voice recordings for customers who have enabled the feature on supported products.	USA, Australia and the Philippines	Data Privacy; Data Security
AWS	All services	Personal data contained in communications sent through or uploaded to the services.	Infrastructure Provider providing hosting services and storage.	USA*	Compliance Program; GDPR Centre; Supplementary Measures Addendum; Blog
AWS	Programmable Voice	Personal data contained in voice communications.	Text to speech functionality for customers using Amazon Polly.	USA	Compliance Program; GDPR Centre; Supplementary Measures Addendum; Blog
AWS	Programmable Video	Personal data contained in streamed videos.	Streaming and interactive video.	USA*	Compliance Program; GDPR Centre; Supplementary Measures Addendum; Blog
AWS	Marketing Campaigns (SendGrid)	Personal data contained in email communications.	Automation and storage services for marketing campaigns.	USA	Compliance Program; GDPR Centre; Supplementary Measures Addendum; Blog
AWS	Email (SendGrid)	Personal data contained in email communications.	Routing and transmission of emails.	USA	Compliance Program; GDPR Centre; Supplementary Measures Addendum; Blog
Confluent	Twilio Flex	Personal data contained in communications sent through Twilio Flex.	Infrastructure management	USA	Trust & Security
DVLEP/Sabio	Twilio Flex	Personal data contained in voice communications.	Connectivity services to customer’s Google CCAI instance.	USA, EU (for resiliency), and the UK	Data Privacy; Data Security;
Datadog	Segment	System and event logs	Operational monitoring	USA	Data Protection; Security Policies; Compliance Program
GoodData Corporation	Twilio Flex	Personal data contained in communications sent through Twilio Flex.	Data analytics functionality for customers who have enabled the feature in Twilio Flex.	USA	Data Privacy; Data Security & Cloud Security
Google	Segment/Twilio Engage	Personal data contained in communications sent through the Segment Services	Data storage and queries	USA	Data Privacy; Trust & Security; Blog
Google	Programmable Voice; Twilio Flex	Personal data contained in voice communications.	Speech recognition functionality for customers who have enabled the feature on supported products.	USA	Data Privacy; Trust & Security; Blog
IBM LLC.	Segment	Personal data contained in communications sent through the Segment Services	Destination which customers can elect to transmit data to	USA	Trust Office - Security; Trust Office - Privacy
iMerit	Twilio AI	Personal data contained in voice communications.	Human annotation of text files and human transcription of audio files for customers who have enabled the feature on supported products.	USA, India and Bhutan	Data Privacy; Data Security
Microsoft	Segment	Personal data contained in communications sent through the Segment Services	Destination which customers can elect to transmit data to	USA	Privacy Program;
Snowflake	Marketing Campaigns (SendGrid)	Personal data contained in email communications.	Automation and storage services for Marketing Campaigns.	USA	Security Addendum; DPIA Fact Sheet;
Snowflake	Segment	Personal data contained in communications sent through the Segment Services	Destination which customers can elect to transmit data to	USA	Security Addendum; DPIA Fact Sheet;
TranscribeMe	Twilio AI	Personal data contained in voice communications.	Human annotation of voice recordings for customers who have enabled the feature on supported products.	USA and the Philippines	Data Privacy; Security Policies
VoiceBase	Programmable Voice; Twilio Flex	Personal data contained in voice communications.	Transcription services for customers who have enabled transcriptions on supported products.	USA	Data Privacy; Data Security

* If using Regional Twilio for supported products, Customer Content is stored and processed in the region selected (Ireland or Australia). Exceptions will occur as necessary to investigate issues of fraud and abuse. At this time, all other data relating to your account and use of the Twilio Services will continue to be processed in the United States to allow Twilio to continue to provide and improve our Services to you.

Twilio Group Sub-Processors

Sub-Processor	Applicable Service(s)	Subject matter	Nature and purpose of processing	Location(s) of processing	External links for additional information relating to security
Segment.io	EventStreams	Personal data contained in communications sent through the Twilio Services	Transmit event data as instructed by Twilio customers	USA	Data Privacy; Data Security
Segment.io	Segment Services	Segment.io acts as a processor for Twilio Inc. for the provision of the Segment Services	Provision of the Segment Services	USA	Data Privacy; Data Security
Twilio Inc.	All Services	If Twilio Inc. is not the Twilio party to the agreement, then Twilio Inc. is acting as a sub-processor for that Twilio party. (For example. If you are contracting with Twilio Ireland Ltd, then Twilio Inc. is acting as a sub-processor for the provision of the services.	Provision of the Twilio Services	USA*	Data Privacy; Data Security;