Compliance Center
Nothing on this page is a claim of GDPR or EU AI Act compliance. It describes the controls that exist in the product today and the records we keep about each sub-processor.
Register entries, status cards and retention details are maintained in English, the language of the underlying records.
Requires legal review
The platform (application, PostgreSQL database, Redis queue, object storage and the automation engine) runs on one server in Frankfurt am Main, Germany. That location comes from the production host's IP registration and geolocation; we are still confirming it against the hosting contract. Not all processing stays in the EU: some providers below are US-based, and AI inference runs on Vertex AI's global endpoint, where Google chooses the serving region.
Requires legal review
Twilio, Anthropic, OpenAI, Resend, Stripe and Slack are US-headquartered. All AI inference runs on Google Cloud (Vertex AI), using Google's Gemini models, on Vertex's global endpoint — Google picks the serving region, worldwide, so AI inference is not EU-pinned and we make no EEA-residency claim for it. The application, database, object storage and backups do stay on the Frankfurt server. Anthropic remains a sub-processor only for an emergency fallback path and is not used for AI processing otherwise. Counsel has not yet confirmed which transfer mechanism covers each provider, so we do not claim SCCs, Data Privacy Framework reliance or zero data retention.
Requires legal review
The published DPA (version 2026-10-12-draft) is a draft for counsel review. It is not a signed agreement, and the platform will not record a DPA as executed until the template is approved.
Available
Conversations are deleted automatically 12 months after last activity by default. An agency or client can set a period from 1 to 3650 days, never unlimited. Every scheduled cleanup run is logged.
Available
Agencies and their clients can export their data from the portal at any time. After an approved closure the account is disabled, then permanently purged after 30 days. Database backups roll off within 14 days.
Planned
Every client's voice configuration has an AI disclosure turned on by default and localized for the configured language. The configuration puts it first, before the business prompt, with no barge-in allowed while it plays. Only AgentLane can turn it off, with a recorded reason. The voice runtime was deployed on 2026-09-20 and has so far played this only in AgentLane's own internal test calls — no end customer has heard it yet. This is a technical control, not a legal conclusion.
Planned
The AI voice runtime was deployed on 2026-09-20 and is in limited internal testing against a single AgentLane-operated test client; no end customer has been answered by it. Twilio is also used for missed-call detection and SMS. Each language configuration requires validation and explicit sign-off before any production use.
Planned
There is no outbound dialer. Outbound is disabled by default for every client. Before it can be enabled, a call must pass consent, do-not-contact, calling-hours, purpose and disclosure checks, and the policy must be legally approved.
Available
Numbers normally live in the Twilio account of the agency or its client, so they stay with that account if you leave. Confirm per client, because a platform Twilio fallback account also exists.
Available
AgentLane does not add a per-minute telephony fee. Telephony usage (calls and SMS) is billed separately by the Twilio account that owns the number. AI model usage is either metered in AI credits on managed-AI plans or billed directly by the provider when an agency or client uses its own API key. There is no minimum term: card plans cancel from the portal and invoiced plans by email, in both cases effective at the end of the billing period.
Only vendors actually integrated in the platform are listed. A review date means a named person at AgentLane recorded a review of that vendor's terms; it is not a certification.
Register version 2026-10-12
| Vendor | Purpose | Region | Transfer mechanism | Last reviewed |
|---|---|---|---|---|
| VPS hosting provider (IP registered to xTom GmbH) | Hosting and storage of all platform data | Germany (Frankfurt am Main) — inferred from IP geolocation of the production host on 2026-09-13; the hosting contract is not in the repository | Not applicable if the provider and its support access stay in the EEA — both unconfirmed | Not yet reviewed |
| Twilio | Missed-call detection and SMS conversations on behalf of the end client | United States-headquartered provider; no Twilio regional processing option is configured in this repository | Not confirmed — requires legal verification of the executed vendor terms | Not yet reviewed |
| Anthropic | Emergency circuit-breaker fallback only, on the platform key. Not used for tenant BYOK — Anthropic BYOK is retired and no inference path reads a tenant Anthropic key (apps/api/src/agent-requests/application/validate-credentials.handler.ts:81-96). | United States-headquartered provider; region not configurable in this repository | Not confirmed — requires legal verification of the executed vendor terms | Not yet reviewed |
| Google Cloud EMEA Ltd / Google LLC (Vertex AI) | Generating AI replies in automations (AI proxy), voice turns and the in-portal support chatbot — the active default inference path for every tenant | Vertex AI's global endpoint (GOOGLE_VERTEX_LOCATION=global) — Google routes each request to a region of its own choosing, worldwide. No region is pinned and no EEA residency is claimed for AI inference. Owner decision 2026-09-22: the EU single-region endpoints (europe-west4, europe-west1) serve only the Gemini 2.5 family, not the Gemini 3.x models AgentLane runs (docs/vertex-region-decision-2026-09-22.md). | Google Cloud Data Processing Addendum plus Standard Contractual Clauses — proposed, not yet executed or verified | Not yet reviewed |
| OpenAI | Alternate AI provider behind the AI proxy | United States-headquartered provider; region not configurable in this repository | Not confirmed — requires legal verification of the executed vendor terms | Not yet reviewed |
| Cal.com | Creating bookings in the end client calendar | Depends on the Cal.com account the client connects | Not confirmed — requires legal verification of the executed vendor terms | Not yet reviewed |
| Dentally (dental practice management system) | Controlled pilot only — not in use for real patients. Looks up a caller by phone number against the practice's own Dentally patient records and writes an appointment into the practice's diary. Reachable only in a pilot stage that is restricted by attestation to synthetic data; no real patient data has been sent. | Not confirmed. Dentally is a UK-market cloud practice system hosted in the vendor's own infrastructure; the practice holds the Dentally contract (BYOK) and the hosting region is not stated in the repository or verified from a contract. | Not confirmed — requires legal verification of the executed vendor terms | Not yet reviewed |
| Resend | Account emails and automation emails | United States-headquartered provider; region not configured in this repository | Not confirmed — requires legal verification of the executed vendor terms | Not yet reviewed |
| Stripe | Billing agencies for AgentLane fees | United States-headquartered provider | Not confirmed — requires legal verification of the executed vendor terms | Not yet reviewed |
| Slack | Alerting AgentLane staff about platform incidents | United States-headquartered provider | Not confirmed — requires legal verification of the executed vendor terms | Not yet reviewed |
| Google Analytics 4 | Understanding marketing-site traffic. AgentLane acts as controller here, not as a processor for clients. | Google infrastructure; region not configured | Not confirmed — requires legal verification of the executed vendor terms | Not yet reviewed |
No sub-processor changes have been recorded yet.
Changes to this list are announced here and by email to subscribers. We send a confirmation link first; nothing else is sent until you click it.
| Data | Default period | How it is enforced |
|---|---|---|
| Conversation transcripts and call/SMS metadata | 365 days | PurgeConversationsJob, daily 03:00, measured from last activity. RETENTION_CLEANUP_DRY_RUN=true switches it to counting only. |
| Call audio recordings | — | AgentLane writes no call audio to disk in any transcript mode; the voice runtime processes it in transit only. Twilio-side recording settings live in the Twilio account that owns the number and are outside AgentLane control. |
| Voice call transcripts (turn text; only for clients in transcript_with_caller_notice mode, and only on calls where the caller heard the notice and did not object) | 30 days | PurgeVoiceTranscriptsJob, daily 03:50, measured from the call start time against an expiry stamped on each transcript when it is written. The period is set per client (1–90 days, 30 by default) and is never unlimited. Text is encrypted at rest and phone numbers and e-mail addresses are masked before storage by default. A transcript is also deleted whenever its call record is (the voice_calls row cascades to it), so it never outlives the call record. The default voice mode stores no transcript at all. RETENTION_CLEANUP_DRY_RUN=true switches the job to counting only. |
| Voice call records (per-call metadata; no audio, no transcript) | 90 days | PurgeVoiceCallsJob, daily 03:45, measured from the call start time. It deletes the per-call rows — the only voice records that keep any part of a caller number (its last four digits; the full number is never stored). The aggregated voice-minute counters in usage_events are deliberately kept as usage history: each holds a minute count against a Twilio call identifier and no caller number. Agencies and clients can set a shorter or longer period (1–3650 days), never unlimited. RETENTION_CLEANUP_DRY_RUN=true switches the job to counting only. |
| Internal workflow engine run payloads (not yet in use; trigger input and per-step input/output, which can contain a customer phone number, e-mail address or message text) | 30 days | PurgeWorkflowRunPayloadsJob, daily 03:55, measured from the run start. After 30 days the payload columns are set to NULL; the run and step rows (status, timing, step names, public error text) are kept as a record containing no customer data. Credentials are never stored in a run. The rows are deleted outright when the account is purged. RETENTION_CLEANUP_DRY_RUN=true switches the job to counting only. |
| In-portal support chatbot conversations | 365 days | RetentionExtendedCleanupJob, daily 03:30, measured from the session last update. |
| Outbound webhook delivery logs (operational logs) | 90 days | RetentionExtendedCleanupJob. |
| Application audit log | 1095 days | RetentionExtendedCleanupJob. Deleting audit evidence is a legal decision; keep dry-run until counsel sets the period. |
| Generated data-export archives | 7 days | PurgeDataExportsJob deletes the archive and its row after expiry. |
| Accounts approved for deletion (grace period before purge) | 30 days | PurgeDeletedAccountsJob, daily 04:00. |
| Raw Stripe webhook records | 730 days | PurgeBillingRecordsJob. |
| Application container logs | — | Size-based rotation (50 MB x 3 files per container), not time-based. |
| PostgreSQL backups | 14 days | agentlane-backup.timer with 14-day rotation. Deleted data persists in backups until they rotate out. No offsite copy, no restore test recorded. |
| Legacy home-services tables (conversations, messages, bookings, quotes, events, opt-outs) | — | No retention job. Deleted only when a bridged client is purged. Documented gap (docs/gdpr-compliance-audit.md E5). |
Security and privacy contact: contact@agentlane.agency
Requires review and approval by qualified legal counsel in the relevant jurisdictions before being presented as final contractual/legal documentation.
DPA (draft) · Privacy Policy · Cancellation Policy · Product documentation