Aircall
Telephony · aircall.io · last read 2026-10-12
Identity
No identity observation recorded yet.
Data location
| Region | EU data location | Minimum plan | Source | Observed |
|---|---|---|---|---|
| EU | EU by default | — | aircall.io | 2026-10-08 |
EU: New accounts are automatically assigned a US, EU, or Australia hosting location based on the phone number/country code used at signup; the customer doesn't choose it, and no plan or cost is named. It only covers call recordings, voicemails, transcriptions and AI Assist insights. Account, billing, analytics and support data stay in the US regardless of region.
Subprocessor chain
24 third parties · 6 of the vendor's own group companies · 26 with a country outside the EEA · all read 2026-10-08
| Subprocessor | Country | Purpose |
|---|---|---|
| Amazon Web Services | US, DE, AU | Hosting of all data in Aircall product. |
| AssemblyAI, Inc. | US | Generation of transcription from call recordings |
| Atlassian | US | Customer Support: ticketing, chatbot systems for assistance |
| Cartesia AI, Inc. | US | Provision of inputs for AI Voice Agent |
| ClickHouse | US | Data analytics and data processing services. |
| Datadog | US | Monitoring for provided services/security purposes. |
| Deepgram, Inc. | US | Generation of transcription from call recordings |
| Eleven Labs Inc. | US | Provision of inputs for AI Voice Agent |
| Intercom | US | Customer Support: ticketing, chatbot systems for assistance |
| Looker | DE | Data visualization and sync |
| Looker Data Sciences, Inc. | DE | — |
| Microsoft Corporation | US | Generation of conversation insights (Call summarisation, Key topics list, Talk ratio etc.) from voice transcriptions; Provision of inputs for AI Voice Agent |
| PartnerHero | US, RO | Customer Support: support agents |
| Pinecone | US, IE | Storage and retrieval of vector embeddings to support AI-powered search and the customer knowledge base. |
| Pusher | US, GB | Data visualization and sync |
| Pusher Ltd | US, GB | — |
| Ribbon | US | Call authentication/verification, call security and call-routing control. |
| Rudderstack | US | Data visualization and sync |
| RudderStack Inc. | US | — |
| SideGuide Technologies, Inc. | US | Retrieval and processing of customer provided source data to support customer created knowledge base within the Aircall product. |
| Startree | US | Real time call data tracking (data visualization and sync) |
| Startree, Inc. | US | — |
| Twilio | US | Voice transmission services. |
| Zendesk | US, IE | Customer Support: ticketing, chatbot systems for assistance |
Aircall's own group companies listed as subprocessors (6)
| Company | Country | Purpose |
|---|---|---|
| Aircall PTY LTD | AU | Processing activities within the provision of Aircall's product and services |
| Aircall SAS | FR | Processing activities within the provision of Aircall's product and services |
| Aircall Telecom India Private Limited | IN | Processing activities within the provision of Aircall's product and services |
| Aircall Telecom SL | ES | Processing activities within the provision of Aircall's product and services |
| Aircall UK Ltd | GB | Processing activities within the provision of Aircall's product and services |
| Aircall.io, Inc. | US | Processing activities within the provision of Aircall's product and services |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Processing terms
From the vendor's data processing agreement · read 2026-10-09 · aircall.io
| Term | What the agreement says |
|---|---|
| Transfer mechanism | EU-U.S. DPF |
| Transfer mechanism | SCC module 2 |
| Transfer mechanism | SCC module 3 |
| Transfer mechanism | UK Addendum |
| Transfer mechanism | other |
| Notice of new subprocessors | 10 business days prior notice of sub-processor changes (SCC Clause 9 Option 2); notice method not stated in this part |
| Notice of new subprocessors | Email to the Admin User Email Address of intended changes; no advance notice period stated |
| If you object to one | May reasonably object in writing within 10 business days of notice; otherwise deemed to agree; if customer objects, parties negotiate a mutually satisfactory solution |
| Breach notification | promptly after detection; no later than 24 hours after detection where European Data Protection Law applies; by email to Admin User Email Address |
| Audit | Audit by customer or approved independent third-party auditor, only if granted by applicable law and on proven reasonable grounds, a regulator request, or a direct legal right; at most once per 12 months; at least 30 days' notice; each party bears its own costs |
Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.
Assurance
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| CSA CAIQ Level 1 · CAIQ | Claimed | A compilation of +250 common security questions. | aircall.io | 2026-10-08 |
| GDPR | Claimed | — | aircall.io | 2026-10-08 |
| ISO 27001 · ISO27001 | Claimed | information security program is aligned with ISO 27001 (alignment stated, not certification) | aircall.io | 2026-10-08 |
| SOC II | Claimed | information security program is aligned with SOC II standards (alignment stated, not attestation) | aircall.io | 2026-10-08 |
| SOC2 Type 2 · SOC2T2 | Claimed | — | aircall.io | 2026-10-08 |
Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.
Official registers
| Register | Offering, as the register names it | Status | Level | Valid until | Observed |
|---|---|---|---|---|---|
| Data Privacy Framework List (US) | EU-U.S. Data Privacy Framework · Aircall.io, Inc. | Active | HR data, non-HR data | 2027-01-29 | 2026-10-09 |
| Data Privacy Framework List (US) | Swiss-U.S. Data Privacy Framework · Aircall.io, Inc. | Active | HR data, non-HR data | 2027-01-29 | 2026-10-09 |
| Data Privacy Framework List (US) | UK Extension to the EU-U.S. DPF · Aircall.io, Inc. | Active | HR data, non-HR data | 2027-01-29 | 2026-10-09 |
- ACN qualified cloud (Italy): checked 2026-10-12, no entry under Aircall
- DORA critical ICT third-party providers (ESAs): checked 2026-10-12, no entry under Aircall
- Data Privacy Framework List (US): checked 2026-10-12, 3 entries under Aircall
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-10-12, no entry under Aircall
- FedRAMP Marketplace (US): checked 2026-10-12, no entry under Aircall
- SecNumCloud qualified services (ANSSI, France): checked 2026-10-12, no entry under Aircall
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
Support window
Not yet collected. This row will say not declared only once we have read a lifecycle or security page and found no period stated — see support windows.
Vulnerability reporting: (security.txt, no Contact field; no Expires field; read 2026-10-11)
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| certifications | Public | full | 200 | 2026-10-08 |
| dpa | Public | full | 200 | 2026-10-09 |
| residency | Public | full | 200 | 2026-10-08 |
| subprocessors | Public | full | 200 | 2026-10-08 |
History
Nothing has moved since we started watching this vendor on 2026-10-08. Changes appear here only after a human has reviewed them.