The third parties we use to deliver SalesRelay, what each one does, and where it processes data. We will update this page before adding a new subprocessor that handles personal data, and agency customers can ask to be notified of changes.
Runs the SalesRelay application and its database, including the disk the database is stored on. Processes all transaction and account data.
Resend (email delivery) — Ireland (EEA)
Sends account and transaction emails on our behalf. Processes recipient name and email address, subject line and message body. Delivery metadata is retained by Resend; we do not retain the body of a sent email once it has gone.
Amazon Web Services, SES (email infrastructure) — Ireland (EEA)
Resend sends through Amazon SES, so AWS processes the same email data in transit. Named here because it sits underneath our email provider rather than being appointed by us directly.
Amazon Web Services, S3 (backup storage) — London, United Kingdom
Holds our nightly database backups. Every backup is encrypted by us, on our own server, before it is uploaded, so AWS stores ciphertext and cannot read the contents. The decryption key is held only by us and is never sent to AWS.
Anthropic (AI extraction) — United States
Reads inbound message content to extract structured facts, where AI extraction is enabled. Message content is sent for processing and is not used to train models. This is our only subprocessor outside the UK and EEA. A deterministic fallback parser is available if you prefer no third-party AI processing — tell us and we will disable it for your account.
A note on backups
Backups are the most concentrated copy of personal data we hold: a single file containing every transaction on the platform. We encrypt each one with AES-256 before it leaves our server, so the storage provider only ever receives ciphertext. A misconfigured bucket, or a compromise of our storage account, would not expose any client data.
Backups are stored in London, are deleted on a rolling basis rather than kept indefinitely, and are restore-tested rather than assumed to work.
Not currently appointed
We have no payment provider, because SalesRelay is not yet charging anyone. It will appear here, before it processes any personal data, when that changes.
Choosing not to use AI extraction
SalesRelay was built so that the AI interprets but never decides. If your agency would rather no message content left our own infrastructure, the rule-based extraction engine can be used instead. It is less flexible with unusual phrasing, but the chasing, evidence and escalation behaviour is identical.
Questions
For the current named list, regions, and a copy of our DPA, email hello@salesrelay.uk.