Legal
· Last updated July 9, 2026
Subprocessors
Waveguide (operated by Adwave) uses the following subprocessors to provide the Service. Core subprocessors are
involved in providing the Service to every tenant; feature-specific subprocessors process data only when you use
the corresponding feature. We will update this page before adding subprocessors that process Customer Data —
material changes are announced per our Privacy Policy.
Core subprocessors
| Subprocessor | Role | Data touched | Location |
|---|
| Cloudflare | Control plane, database, storage, queues, static hosting | All service data | Global (US-based) |
| Fly.io | Sandboxed agent compute | Workspace contents during sessions | US/EU regions |
| Anthropic | AI model inference | Session context (never credentials) | US |
| Stripe | Billing and payments | Billing identity, payment method, usage totals | US |
| Composio | OAuth connection broker | Connected-account auth (tokens masked at Composio; Waveguide uses proxy execute) | US |
| Postmark | Inbound email processing (owner forwards, reply-to-approve, outreach replies) | Mail sent to your tenant inbound address | US |
| Resend | Outbound transactional email and hosted mission outreach sending | Your email address, notification content, outreach message content and recipient addresses | US |
Feature-specific subprocessors
| Subprocessor | Feature | Data touched | Location |
|---|
| Slack | Slack reporting channel | Messages the agent exchanges with you | US |
| Telegram | Telegram reporting channel | Messages the agent exchanges with you | Global |
| Retell | Outbound voice calls (missions) | Call audio, transcripts, called numbers | US |
| Deepgram | Speech-to-text for meeting attendance | Meeting audio during attended calls | US |
| ElevenLabs | Text-to-speech for voice features | Generated speech audio | US |
| Ayrshare | Social posting (missions) | Post content, connected social account identifiers | US |
Notes
- Credentials never leave the vault. No subprocessor other than our infrastructure providers (Cloudflare) and
the OAuth broker (Composio) holds connected-account credentials and Waveguide calls providers through Composio proxy execute, and no AI model
provider ever receives them.
- No training. Our agreement with Anthropic prohibits training on your session content. We do not train models
on Customer Data.
- Questions about this list, or need it as part of vendor review? Email
hello@waveguide.adwave.com with the subject “Privacy request”.