Trust Center

This notice supplements the update to our Subprocessor List at security.vapi.ai, made in accordance with Section 3.2 of the Vapi Data Processing Addendum (the “DPA”).

What is changing
WorkOS, Inc. (“WorkOS”) currently supports single sign-on (SSO) for the Vapi platform. Effective July 31, 2026, WorkOS’s role will expand to provide authentication services more broadly. As part of this change, end-user authentication data that was previously stored within your region (via Supabase) will be processed by WorkOS on infrastructure located in the United States.

Subprocessor details
Subprocessor: WorkOS, Inc.
Service: Authentication (previously SSO only)
Processing location: United States
Categories of data: Authentication identifiers and account information (e.g., name, email address, user/account identifiers) and system metadata (e.g., timestamps, device identity, IP address). Does not include call recordings, transcripts, call logs, or conversation content.
Data subjects: Your employees and end users who authenticate to your Vapi-powered application.

For customers in the EEA, UK, and Switzerland
This change involves a transfer of personal data to the United States. Such transfers continue to be made under the Standard Contractual Clauses incorporated into your DPA with Vapi (Section 5), including the UK Addendum and Swiss adaptations where applicable. Vapi’s onward transfer of authentication data to WorkOS is itself governed by Standard Contractual Clauses (with UK and Swiss supplements) under Vapi’s data processing agreement with WorkOS.

For customers in Australia
Vapi handles personal information consistent with Australian Privacy Principle 8. WorkOS is contractually bound, under Vapi’s agreement with WorkOS, to protect personal information through security, confidentiality, and onward-transfer obligations.

If you have any questions regarding this update, please contact us at security.vapi.ai or via privacy@vapi.ai.

We've updated our subprocessor list with the addition of Databricks, which will be used as our primary data platform to support the delivery and operation of our services. Databricks may process customer data to support the provision of our services, provide analytics capabilities and improve our products and services.
Databricks is hosted in the United States and is subject to appropriate contractual, security, and privacy safeguards consistent with our third-party risk management program.
The complete and updated list of subprocessors is available in Vapi Trust Center dashboard under the "Subprocessors" tab. Should you have any questions, please contact your account representative.

We’ve updated our subprocessor list with the addition of Soniox, a transcription service provider that customers may optionally select within the Vapi dashboard. When selected by a customer, Soniox may process audio and related data for the purpose of providing transcription services as part of our services. Soniox is available for customers using our US and EU deployments and may also be used by customers who have enabled the HIPAA mode.

The complete and updated list of subprocessors is available in Vapi Trust Center dashboard under the "Subprocessors" tab. Should you have any questions, please contact your account representative.

Check out the executive summary for our most recent independent third-party penetration test for 2025! Now available in Documents in our Trust Center.