RingCentral adds AI subprocessors almost every month

The change

On June 13, 2026, RingCentral updated its DPA Subprocessor List, adding two new AI subprocessors. Venpo detected the change the same day.

The two additions are xAI for speech-to-speech processing and Fireworks.ai for large language model hosting. Both are US-based and both rely on Standard Contractual Clauses for relevant international transfers. According to the document, they apply to RingEX, RingCentral AI Receptionist, and RingCentral AI Representative (AIR Pro).

RingCentral sits in the communications layer of a large number of companies, handling calls, voicemail, and messaging. A change to which AI vendors can process that traffic is exactly the kind of update that rarely reaches the people who approved the vendor in the first place.

What changed

Two subprocessors were added to the list:

• xAI, for speech-to-speech processing, based in Palo Alto, California

• Fireworks.ai, for LLM hosting, based in San Mateo, California

Speech-to-speech is the more sensitive of the two. It means voice from a customer conversation can be processed directly by xAI's models. LLM hosting through Fireworks.ai means text and prompts tied to RingCentral's AI features can be processed on infrastructure run by another external provider.

Both additions were filed as routine subprocessor list entries. There was no separate announcement, and the only marker was a new row in the document's recent changes table.

The pattern is the real story

A single subprocessor addition is rarely a headline. What makes this one worth attention is the cadence around it. RingCentral's own change log shows AI subprocessors being added almost every month:

• June 13, 2026: xAI and Fireworks.ai

• May 20, 2026: additional processing locations for ElevenLabs

• May 13, 2026: Cartesia

• April 29, 2026: AI WFM subprocessors

• March 18, 2026: AI Quality Management

• March 16, 2026: AI Representative (AIR Pro)

The list of AI and machine learning providers now touching RingCentral communications data includes Google, AWS, Microsoft, OpenAI, Deepgram, ElevenLabs, Cartesia, ClickHouse, and now xAI and Fireworks.ai. Each addition is individually defensible. Taken together, they represent a steadily widening set of third parties that can process voice and messaging data, growing faster than any annual review cycle can track.

Why this matters

Subprocessor lists are one of the few places where a vendor discloses exactly who else touches your data. They are also one of the most frequently updated documents a vendor maintains, and almost never announced. This is the exact category of silent change covered in our analysis of the hidden risk of vendor legal changes.

When AI subprocessors are added at the pace RingCentral is moving, two things happen. The data exposure surface grows, and the documentation that security and compliance teams approved at onboarding falls out of date within weeks. A team that vetted RingCentral six months ago approved a materially different set of subprocessors than the one in place today.

This is also part of a broader market shift. The same dynamic is visible across the stack, from Anthropic narrowing its data retention commitments to analytics vendors changing their AI data defaults. AI providers are being woven into vendor stacks faster than governance processes were built to handle.

Potential impact for SaaS companies

Companies using RingEX, AI Receptionist, or AIR Pro may want to review whether:

• their data processing records still match RingCentral's current subprocessor list

• their security and compliance approval accounted for voice data being processed by speech-to-speech AI models

• customer-facing privacy documentation and DPAs reflect the AI providers now in the chain

• any of these new subprocessors fall outside their approved data residency or transfer assumptions

For teams that maintain their own subprocessor disclosures downstream, a change like this can cascade: your vendor's new subprocessor may need to appear in your own documentation. Tracking that manually across a full vendor portfolio is exactly where monitoring AI subprocessors becomes a structural necessity rather than a periodic task, and where continuous vendor risk monitoring earns its place in the compliance stack.

How Venpo detected it

Venpo continuously monitors vendor legal documents and detects changes in real time. When RingCentral updated its subprocessor list, Venpo immediately:

• detected the two new subprocessor rows the day they were published

• identified xAI and Fireworks.ai and the products they apply to

• flagged the change as a privacy-relevant expansion of the data processing chain

• placed it in the context of RingCentral's ongoing subprocessor additions

Instead of discovering a new AI vendor in the chain during the next annual review, or worse, during a customer security questionnaire, teams understood the change on the day it shipped. Subprocessor lists change too often for manual tracking to keep up, which is the central argument in our comparison of manual vs automated vendor monitoring.

Business outcome

Companies that caught this change early were able to:

• update their vendor and data processing records to include xAI and Fireworks.ai

• review whether speech-to-speech processing fits their internal data handling policies

• confirm their customer-facing disclosures still match reality

• brief security and compliance before the next audit or customer review

Instead of reacting to a gap found during due diligence, they adapted on their own schedule. This is the difference between operating with current information and operating on assumptions from the last review cycle.

Key takeaway

Subprocessor lists are where AI sprawl shows up first, and they change faster than almost any other vendor document. A single added row can put your customers' voice data in front of a new AI model, and the only way to know it happened is to be watching the document when it changes. Venpo detected this addition the day it was published and placed it in the context of a months-long pattern. A closer look at why scheduled reviews keep missing this kind of change is in our analysis of manual vs automated vendor monitoring.