Last updated: April 23, 2026 · Privacy Policy · Terms of Use

Sub-processors

Kora engages the third-party service providers listed below to help deliver the Services. Each sub-processor is bound by contractual obligations to handle personal information consistently with our Privacy Policy and applicable law. Operators may also engage their own sub-processors (for example, integrated calendars, accounting tools, or marketing systems) and are responsible for disclosing those to their guests where required.

We may update this list from time to time as our infrastructure evolves. Material changes will be reflected by updating the “Last updated” date above, and operators on plans with prior-notice rights will be notified in accordance with their agreement.

  • Stripe, Inc.

    Purpose
    Payment processing, payouts (Stripe Connect), Stripe Billing for operator subscriptions, and fraud prevention.
    Where data is processed / stored
    United States; Stripe regional infrastructure as configured.
    Data shared
    Payment method metadata, transaction amounts and status, billing addresses, customer references, and information required for KYC/AML on Connected Accounts.

  • Resend, Inc.

    Purpose
    Transactional and product email delivery (confirmations, reminders, receipts, account notices).
    Where data is processed / stored
    United States; EU regions per Resend configuration.
    Data shared
    Recipient email addresses, message content, delivery and engagement metadata.

  • Twilio Inc.

    Purpose
    SMS delivery and short-message reminders where enabled by an operator.
    Where data is processed / stored
    United States; regional endpoints per Twilio configuration.
    Data shared
    Recipient phone numbers, message content, delivery metadata.

  • Vercel Inc.

    Purpose
    Hosting and edge delivery of the Kora web application and marketing site.
    Where data is processed / stored
    Global edge network; primary region per project configuration.
    Data shared
    HTTP request data, IP addresses in access and security logs, deployment artifacts.

  • Railway Corp.

    Purpose
    Hosting of API services, PostgreSQL database, and Redis queue infrastructure.
    Where data is processed / stored
    Per Railway project region.
    Data shared
    Application data at rest in Postgres, queue metadata in Redis, request and worker logs.

  • Cloudflare, Inc.

    Purpose
    DNS, edge caching, DDoS protection, and bot mitigation for Kora-managed domains.
    Where data is processed / stored
    Global edge network.
    Data shared
    HTTP request metadata, IP addresses, security event logs.

  • ElevenLabs, Inc.

    Purpose
    AI Voice Agent (Conversational AI) for operators that enable the Voice Agent add-on.
    Where data is processed / stored
    United States.
    Data shared
    Caller phone numbers, call audio and transcripts, agent configuration, and usage metrics.