Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This page describes what the document states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability may vary by jurisdiction. Methodology
This document lists the third-party companies Twilio uses to process customer data and explains the rules those companies must follow. Your data is processed for as long as you use Twilio services and for whatever retention period your agreement specifies—it is not automatically deleted when you stop using a service unless your agreement says so. Unless you have set up a regional data arrangement selecting Ireland or Australia, your account and usage data is processed in the United States.
This document establishes Twilio's sub-processor framework, identifying the third parties Twilio engages to process customer personal data and the obligations imposed on them. Sub-processors are contractually required to implement appropriate technical and organizational measures meeting applicable data protection law standards. Personal data retention by sub-processors runs for the duration of active service use and for any retention periods defined in the customer's agreement with Twilio. Cross-border transfers involving sub-processors have been evaluated through Transfer Impact Assessments, and data residency is governed by customer-selected regions (Ireland or Australia) for Regional Twilio supported products, with a default of United States processing for all other account and service usage data. Telecommunications providers used by Twilio are explicitly excluded from the sub-processor classification and its attendant obligations.
As an individual user, your personal data is held by Twilio's sub-processors for the full period you use the applicable service and any additional period your agreement specifies. Key infrastructure, including AWS, processes data in the USA, and third-party sub-processors such as OpenAI and Lakera also operate in the USA within Twilio's automated and AI-powered workflows. Telecommunications providers are not covered by the sub-processor obligations described in this document. One concrete action available to you: you can subscribe to Twilio's sub-processor change notifications to receive updates whenever the list of sub-processors is modified.
Which mapped governance frameworks each document engages, tied to the specific provisions that engage them.
Every distinct legal provision identified in this document. Featured provisions appear above with analysis.
Twilio has updated this document before. Monitor includes same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
Need provision-level monitoring and regulatory mapping? Insight includes governance timelines, drift analysis, and full provision tracking.
Cross-platform context
See how other platforms handle Duration of processing tied to customer service use and similar clauses.
Compare across platforms →Governance Monitoring
Structured alerts for policy changes, governance events, and provision updates across 352+ platforms.