KokuaOS — Subprocessor Policy
Effective July 18, 2026 · Version 1.0
How KokuaOS engages and manages Subprocessors, how customers receive notice of changes and may object, and why customer-selected BYO Providers are not KokuaOS Subprocessors.
Capitalized terms have the meanings in the KokuaOS Definitions Schedule (kokuaos.com/legal/definitions).
1. Purpose
KokuaOS uses a limited set of third parties to help deliver the Platform and the Services. This Policy explains what a Subprocessor is, the categories of Subprocessors KokuaOS engages, how KokuaOS oversees them, how customers are notified of changes, and how eligible customers may object. It also draws the important line between KokuaOS Subprocessors and BYO Providers that a Customer or Service Provider selects and controls.
2. What a Subprocessor is
A Subprocessor is a third party engaged by KokuaOS to process Personal Data on KokuaOS's behalf in providing the Services. Subprocessors act under KokuaOS's instructions and under contractual obligations consistent with this Policy and the Data Processing Addendum (kokuaos.com/legal/dpa). This Policy addresses Subprocessors that process Personal Data; KokuaOS also uses ordinary vendors and tools that do not process Personal Data, which are not Subprocessors and are not covered here.
3. Categories of KokuaOS Subprocessors
KokuaOS engages Subprocessors by function. The categories below describe the types of Subprocessors KokuaOS uses, the general purpose of each, and the types of data they may process. The current, authoritative list of KokuaOS Subprocessors — including entity names, the functions they perform, and their processing locations — is maintained at the Trust Center (/trust). Where a category is not used for a particular Service or configuration, no Subprocessor in that category processes the related data.
| Function / category | General purpose | Illustrative data types |
|---|---|---|
| Cloud hosting and infrastructure | Host and run the Platform, storage, compute, and networking | All categories of Customer Data and account data, as hosted |
| AI / LLM inference and model orchestration | Generate AI Output; speech, language, retrieval, and reasoning processing | Prompts, transcripts, Knowledge Base content, and related inputs and outputs |
| Voice, telephony, and media | Carry and process calls, media streams, and messaging traffic | Phone numbers, call metadata, audio, and transcripts where enabled |
| Messaging and email delivery | Send and receive SMS, email, and chat, and deliver notifications | Contact identifiers and message content |
| Analytics and product telemetry | Measure usage and performance and improve the Services | Usage and device data; identifiers |
| Customer support and ticketing | Provide and track support | Contact details and support communications |
| Security, monitoring, and fraud prevention | Protect the Platform and detect abuse | Log data, identifiers, and security telemetry |
| Billing and payment processing | Invoice and collect payment | Billing contact and payment information |
Processing locations are primarily the United States and may include other regions where KokuaOS or a Subprocessor operates; specific locations are identified in the Trust Center list. All Subprocessors are engaged subject to Section 4.
4. How KokuaOS oversees Subprocessors
Before engaging a Subprocessor that will process Personal Data, and periodically thereafter, KokuaOS performs risk-based due diligence appropriate to the data and the function. KokuaOS enters into a written contract with each such Subprocessor that imposes data-protection and confidentiality obligations that are, in substance, no less protective than those KokuaOS owes under the applicable Data Processing Addendum, including obligations to process Personal Data only as instructed and to maintain appropriate security measures. KokuaOS remains responsible to its customers for the performance of its Subprocessors' data-protection obligations as provided in the Data Processing Addendum.
5. Notice of new or replacement Subprocessors
KokuaOS maintains the current Subprocessor list at the Trust Center and updates it when a Subprocessor is added or replaced. Customers who have entered into a Data Processing Addendum, or who subscribe to Subprocessor-change notifications where that option is offered, will receive notice of a new or replacement Subprocessor in the manner and within the notice period stated in the Data Processing Addendum (or, if none is stated, a commercially reasonable advance notice) before KokuaOS authorizes that Subprocessor to process their Personal Data, except where a change must take effect sooner to address security, legal, or continuity needs. To subscribe to notifications, use the mechanism provided at the Trust Center.
6. Objecting to a Subprocessor
A Customer with a Data Processing Addendum (or an enterprise Customer whose Order Form provides this right) may object to a new or replacement Subprocessor on reasonable, good-faith data-protection grounds by notifying KokuaOS within the objection window stated in the Data Processing Addendum after notice under Section 5. The parties will work together in good faith to address the objection, for example by identifying a commercially reasonable alternative or configuration. If the parties cannot resolve the objection within a reasonable period, the objecting Customer's sole and exclusive remedy is to terminate the affected Service that cannot be provided without the objected-to Subprocessor, on written notice, with a pro-rated refund of prepaid, unused subscription fees for the terminated Service (Variable Charges remain non-refundable). KokuaOS does not promise that every customer can veto every Subprocessor, and continued use of a Service after the objection window and resolution period constitutes acceptance of the Subprocessor for that Service.
7. BYO Providers are not KokuaOS Subprocessors
A BYO Provider is a third-party service that a Service Provider or Customer brings, contracts for, and controls for use with the Platform — for example SIP, telephone numbers (DIDs), carriers, media, large language models, speech-to-text/text-to-speech, SMS, email, identity, CRM/ERP/HRIS, payment, and cloud or storage providers. A BYO Provider is a Third-Party Service selected and controlled by the customer, not a KokuaOS Subprocessor. Accordingly:
- KokuaOS does not list BYO Providers on its Subprocessor list, does not select or vet them, and does not provide notice or an objection right for them under this Policy;
- the Customer or Service Provider that brings a BYO Provider is responsible for that provider's contracts, data-protection terms, security, availability, compliance, and any required end-user notices and consents; and
- when Personal Data flows to a BYO Provider at the customer's direction, that flow is governed by the customer's own arrangements with the BYO Provider, not by KokuaOS's Subprocessor obligations.
The BYO Provider Policy (kokuaos.com/legal/byo-providers) and the Data Processing Addendum further describe the allocation of responsibility for BYO Providers.
8. Updates and contact
KokuaOS may update this Policy and the Subprocessor list from time to time. Material changes to this Policy take effect as described in the Master Terms & Conditions; changes to the Subprocessor list are governed by Sections 5 and 6. Questions about this Policy or the Subprocessor list may be directed to privacy@kokuaos.com. The current version of this Policy is published at /legal/subprocessors, and the current Subprocessor list is maintained at the Trust Center (/trust).