Security, Privacy and Compliance Information for Z360
Z360 is a data processor and engages certain subprocessors that may process personal data submitted to the Services by our customers. These subprocessors are listed below, with a description of the service each provides, the location where data is processed, and whether it is covered by Z360's Business Associate Agreement ("BAA"). By default, hosting occurs in the United States. Each subprocessor is bound by a written agreement to protect the data it handles and to use it only to provide services to Z360.
Not every subprocessor applies to every customer. Which subprocessors process your data depends on the features you use. For example, if your organization does not use the AI voice agent, our voice and speech providers do not receive your data.
Subprocessors
| Subprocessor | Service | Location | HIPAA (BAA) |
|---|---|---|---|
| Amazon Web Services, Inc. | Cloud hosting, databases, file storage, backups, AI processing (Amazon Bedrock), and system email | USA | Covered |
| Telnyx LLC | Phone numbers, calls, SMS and MMS, fax, and call recording | USA | Covered |
| LiveKit, Inc. | Real-time voice connections and hosting for the AI voice agent | USA | Covered |
| Deepgram, Inc. | Speech-to-text for calls and call recordings | USA | Covered |
| Eleven Labs Inc. (ElevenLabs) | AI text-to-speech processing for certain AI voices | USA | Not covered |
| Sampark Inc. (Composio) | Connects third-party apps and runs actions in them for the AI agent | USA | Not covered |
| Tiny Fish, Inc. (TinyFish) | Web search and research for the AI agent | USA | Not covered |
| PostHog, Inc. | Product usage analytics | USA | Not covered |
| Laravel Holdings Inc. (Laravel Nightwatch) | Application performance and error monitoring | USA | Not covered |
| Google LLC (Firebase Cloud Messaging) | Mobile push notifications | USA | Not covered |
| Stripe, Inc. | Billing and payment processing (does not process patient information) | USA | Not applicable |
What the HIPAA designations mean
- Covered means the subprocessor may process patient information for organizations with a signed BAA, under its own BAA with Z360.
- Not covered means the subprocessor is outside the BAA and is not approved for patient information.
- Not applicable means the subprocessor does not process patient information.
HIPAA Organizations
If your organization has a signed BAA with Z360 and HIPAA mode is active, only the subprocessors designated as Covered above process patient information. Features that rely on subprocessors designated as Not covered, such as ElevenLabs voices, connected apps, and web research, are not approved for patient information. The subprocessors, services, and settings that apply to your organization are listed in your BAA.
Services You Connect
Accounts that your organization connects to the Services, such as Gmail, Microsoft Outlook, or Facebook Lead Ads, are not Z360 subprocessors. Your own agreement with each provider governs your use of those services.
Changes to This List
- All customers: We update this list and its change history whenever we add, remove, or replace a subprocessor, and we announce the change in the Z360 release changelog at docs.z360.biz/changelog.
- HIPAA organizations: We email your designated contact at least 30 days before we add or replace a subprocessor that processes patient information. If a change is required sooner for legal or security reasons, we will notify you as soon as reasonably practicable.
Change history
| Date | Change |
|---|---|
| September 28, 2026 | First published |
Questions
If you have any questions about this list, please contact us at help@z360.biz.