Security

Sub-processors

We use a small number of carefully vetted third-party services to deliver the Call Milly platform. Each has a Data Processing Agreement in place.

Last updated: 1 January 2026

Amazon Web Services (AWS)

Cloud infrastructure, data storage, and compute

Data location: United Kingdom (eu-west-2)

Twilio

Voice calling and SMS/WhatsApp delivery

Data location: United Kingdom / EEA

OpenAI

AI language model for conversation handling

Data location: EEA (data processing agreement in place, no data retention)

Stripe

Payment processing and billing

Data location: United Kingdom

Postmark

Transactional email delivery

Data location: United States (EU SCCs in place)

Sentry

Error monitoring and application performance

Data location: EEA

Notification of Changes

We will notify you at least 30 days before adding or replacing a sub-processor. If you have concerns about a new sub-processor, you may object in writing within that period. We will work with you to address your concerns or, if they cannot be resolved, you may terminate the affected services.

To receive sub-processor change notifications, email hello@callmilly.com with the subject “Sub-processor notifications”.