Sub-processors
Jalapeño relies on a small number of vendors to deliver service. This page lists every one of them, what each does, and the region it holds data in.
Where your meeting recordings live
Recordings are the most sensitive data Jalapeño handles, so the short version is here rather than buried in the table. A bot operated by Recall.ai (US) captures the call and holds its own copy for up to 30 days. We copy the audio and video into Azure Blob Storage in West Europe, which is where recordings are stored at rest for playback. The transcript and extracted action items are stored in Azure Database for PostgreSQL, also in West Europe. Transcription and AI extraction run on Azure OpenAI, on a Sweden Central resource using Global Standard deployments, so an individual request may be processed in another Azure geography.
We do not currently offer a per-workspace region choice, and we do not offer a Data Processing Agreement or Standard Contractual Clauses yet. Both are roadmap items, described on our privacy policy under international data transfers.
| Sub-processor | Purpose | Region |
|---|---|---|
| Recall.ai | Meeting bot infrastructure. Recall joins your video calls, captures the original audio and video, and returns it to us. Recall holds its own copy of each recording, capped at 30 days per bot, after which Recall deletes it. | US |
| Microsoft Azure Blob Storage | Object storage for meeting recordings at rest. This is where your meeting audio and video files are kept for playback and reprocessing once a call has finished, in a private container alongside profile images. Storage is locally redundant, so copies stay inside the stated region. | West Europe (EU) |
| Microsoft Azure Database for PostgreSQL | Primary database. Meeting transcripts, summaries, action items, account and workspace records, and billing metadata are stored here. | West Europe (EU) |
| Microsoft Azure OpenAI (Azure AI Foundry) | Speech-to-text transcription with speaker diarization, meeting summaries, and action item extraction. Microsoft commits that prompts and completions are not used to train Microsoft or OpenAI models. Azure abuse monitoring is active on our resource, so content its classifiers flag can be stored and reviewed by authorized Microsoft personnel; for resources in the European Economic Area, those reviewers are located in the EEA. | Resource and stored data in Sweden Central (EU). Our model deployments are Global Standard, so an individual transcription or prompt may be processed in any Azure geography where that model is available. |
| Microsoft Azure Container Apps | Application hosting for the API and the web app, together with the container registry and the database migration jobs. Every request and all customer data in transit passes through it. | West Europe (EU) |
| Stripe | Payment processing and subscription billing. Card details are entered with and handled directly by Stripe; Jalapeño does not store full card numbers. We receive billing metadata such as name, email, and the last four digits of the card. | US / Global |
| Resend | Transactional and product email | US / EU |
| Cloudflare | Authoritative DNS for getjalapeno.ai, plus CDN and Cloudflare Workers hosting for the marketing site you are reading now. The application and API are hosted on Azure and are not proxied through Cloudflare. | Global |
| Google Analytics 4 | Aggregated marketing-site analytics (consent-gated) | US / EU |
| Contentsquare | Session-replay analytics on marketing pages (consent-gated) | EU (France) |
Last reviewed: July 30, 2026, against our live infrastructure.
Notice of changes. We post a new or replacement sub-processor to this page at least 30 days before it begins processing customer data. We do not yet run an automated notification list, so if you need that notice delivered by email, contact us and we will add you to it manually.
Integrations you connect yourself. Slack, Google, Microsoft, Zoom, Atlassian, Linear and Asana are not listed above. When you connect one and sync an action item to it, that is a transfer we make at your direction to a service you already control, under your own agreement with that provider, rather than a sub-processor we engage to deliver Jalapeño. Nothing is sent to any of them unless you connect it.
See our security page for the broader set of controls protecting customer data, and our privacy policy for how data is handled across all of these processors.
Have a question about a vendor?
Procurement, compliance, or security teams evaluating Jalapeño can reach us directly for due diligence on any sub-processor on this list.