Sub-processors
Effective date: October 17, 2025
Last updated: November 12, 2025
Xirsys imposes equivalent data protection obligations on sub-processors and remains responsible for their performance under the Data Processing Agreement. Xirsys will provide notice of material changes to this list according to the DPA.
DPAController and processor obligations for client personal data.
SCC AddendumInternational transfer safeguards and annex summaries.
Privacy PolicyPrivacy posture for clients, visitors, and service traffic.
A. Cloud and infrastructure
| Sub-processor | Service / purpose | Typical data processed | Primary processing regions |
|---|---|---|---|
| Amazon Web Services (AWS) | Cloud compute, networking, and network nodes | Live, on-the-wire, end-to-end encrypted media relayed through Xirsys STUN/TURN infrastructure. | As configured by Xirsys globally. |
| DigitalOcean | Cloud compute and network nodes | Encrypted relay traffic as described above. | As configured by Xirsys globally. |
| Hivelocity | Cloud compute and network nodes | Encrypted relay traffic as described above. | As configured by Xirsys globally. |
| Alibaba Cloud | Cloud compute and network nodes | Encrypted relay traffic as described above. | As configured by Xirsys globally. |
| AWS Route 53 | DNS and uptime or health monitoring for APIs | Service telemetry and availability data; no communications content. | Global AWS edge locations. |
| DigitalOcean | Cloud compute and storage | Client account identifiers and operational metadata; no WebRTC media content storage. | As configured by Xirsys globally. |
B. Payments and billing
| Sub-processor | Service / purpose | Typical data processed | Notes |
|---|---|---|---|
| Stripe, Inc. | Payment processing | Billing details and tokenized card data. | Xirsys does not store full card numbers. |
C. Customer support and ticketing
| Sub-processor | Service / purpose | Typical data processed | Notes |
|---|---|---|---|
| Intercom | In-product messaging, support, and product analytics | Client contact information, support communications, and usage metadata. | Used for customer support. |
| Zendesk | Support ticketing and helpdesk | Client contact information and ticket content. | Used for customer support. |
D. Analytics and metrics
| Sub-processor | Service / purpose | Typical data processed | Notes |
|---|---|---|---|
| Google Analytics | Website analytics for www.xirsys.com | Cookie or session IDs and page metrics. | Used for the consumer website only; not applied to STUN/TURN service traffic. |
E. Email and notifications
| Sub-processor | Service / purpose | Typical data processed | Notes |
|---|---|---|---|
| Mailchimp | Marketing emails and notifications | Subscriber email and preference data. | Used for communications to subscribers. |
Additional information and commitments
- Xirsys relays encrypted WebRTC service traffic transiently and does not decrypt, inspect, or store communications content.
- Xirsys maintains an updated sub-processor list and notifies customers of material changes according to the DPA.
- International transfers are supported under the EU Standard Contractual Clauses and UK Addendum described in the SCC Addendum.
- Sub-processor inquiries or objections may be sent to privacy@xirsys.com.