Subprocessors

01Current subprocessors

No vendor has cleared the approval process described below yet, so this table has no rows in it:

REGISTER STATE — ZERO APPROVED ROWS. THE EMPTY TABLE IS THE RECORD, NOT A RENDERING ERROR.

An empty table here means the same thing it means at the DPA's vendor annex: no candidate vendor — including any company whose name might be reasonably guessed from Dohos's public description of itself — has completed the account, contract, and configuration verification the next two sections describe. It does not mean Dohos operates on no infrastructure at all. It means nothing has cleared review for public listing yet.

02What counts as a subprocessor here

Not every company Dohos pays is a subprocessor in the sense this page means. A subprocessor, specifically, is a vendor Dohos engages to process a restaurant's or a caller's personal data on that restaurant's behalf, under the data processing agreement. A company can sell Dohos software, appear in its codebase, or host its public website without ever receiving that kind of data — none of those things puts it on this list.

The reverse also holds: a vendor that does touch this data but plays an independent role — a card network, a bank, a telecom carrier acting under its own regulatory obligations rather than Dohos's instructions — isn't necessarily a subprocessor either, even though it's a real, material recipient of some data. Where that's the case, it's disclosed through the appropriate independent-role channel instead, not folded into this list to make the list look more complete than it is.

03How a vendor earns a row

Before any vendor receives production data or a credential, its relationship with Dohos is classified by criticality, by the sensitivity of the data it would touch, and by whether it would be acting on Dohos's behalf or independently. A free trial or a click-through account doesn't skip this — the same review applies regardless of how the relationship started.

The review itself checks, at minimum:

• the vendor's actual legal identity and where it operates
• its security program — encryption, tenant separation, incident history, vulnerability handling
• its privacy role and instructions, including whether it sells or shares data, and how it supports a rights request
• if the vendor involves an AI or speech model, how its inputs are used, whether it trains on them, and what human review it applies
• its payment role and PCI scope, if relevant
• its own subprocessors, its outage history, and how it would support Dohos exiting the relationship if that became necessary

A trust badge or a marketing page from the vendor isn't sufficient evidence for any of that on its own — the review looks at actual account configuration, not the vendor's public claims about itself.

04What a vendor still cannot do

Clearing review and appearing on this list authorizes a vendor to process the specific data, for the specific purpose, that its row describes — nothing broader. A handful of things stay off no matter which vendor is involved: raw audio recording beyond what's needed to relay a call in the moment, Voiceprints or any biometric use of voice, general model training on restaurant or caller content, advertising use, and combining one restaurant's data with another's.

05Data location, once a vendor is approved

Each row, once one exists, states a specific processing location — not just "United States" as a blanket description, but the actual country or region the account and contract evidence supports. Data residency goes through why that single word "location" actually needs several different answers depending on what's being asked.

06Objecting to a new vendor

Once a restaurant relationship is active under a signed agreement, that restaurant will have a documented window to object to a new or replacement vendor on reasonable data-protection grounds before it goes live. An objection gets acknowledged, the underlying concern gets assessed against the vendor's actual risk profile, and where a change is warranted — a configuration adjustment, a different vendor, a narrower scope — that gets considered rather than dismissed. What an objection process can't require: giving up privilege, disclosing security-sensitive detail, or accepting a vendor whose risk hasn't actually been addressed.

07What a completed row will contain

Every field a real row needs, so a restaurant knows what to expect once one exists:

Related documents

• Subprocessor List and Change Notice — the full public notice this page's table is drawn from, including the change-notice and objection process in contract terms.
• Data Processing Agreement — the agreement that authorizes Dohos to use a subprocessor in the first place.
• Data residency — where an approved vendor's processing is actually located.