Twilio Sub-Processors

This document is Twilio's Sub-Processor List (last updated April 2026), which discloses the third-party companies engaged to process personal data on behalf of Twilio customers, in accordance with customer instructions, and under written contracts imposing data protection obligations aligned with applicable data protection laws. The document states that Twilio imposes obligations on sub-processors to implement appropriate technical and organizational measures, that Transfer Impact Assessments have been performed where cross-border data transfers are required, and that customers may subscribe to notifications of sub-processor changes. The list spans approximately 35 third-party and Twilio Group sub-processors including infrastructure providers (AWS, Google, Microsoft Azure), AI vendors (OpenAI, Anthropic, ElevenLabs, Lakera), analytics platforms (Datadog, Clickhouse, Elastic), and communications delivery services (Sinch, Postmark, VoiceBase), with processing locations spanning the USA, EU member states, UK, South America, and Asia-Pacific regions. The document engages GDPR (including Standard Contractual Clauses and Transfer Impact Assessment obligations under Chapter V), UK GDPR, and potentially CCPA given the volume of personal data categories processed across US-based sub-processors; the footnote clarifying that Regional Twilio stores Customer Content in selected regions (Ireland or Australia) but that all other account data continues to be processed in the United States creates a material residual transfer exposure for EU and UK customers to evaluate. Compliance teams should note that the inclusion of AI vendors such as OpenAI, Anthropic, ElevenLabs, and Microsoft Azure as sub-processors for customer-defined workflows raises questions about onward transfer chains, sub-processor security assurance depth, and alignment with emerging EU AI Act obligations.