SalexHub engages the third parties below to help deliver the platform. Each is bound by written terms no less protective than our Data Processing Agreement, limited to processing on our instructions, and covered by an appropriate transfer mechanism where it processes outside the customer's region.
This page is Annex III of the DPA. We give at least thirty (30) days' notice before a new subprocessor starts processing customer personal data. To receive those notices by email, write to start@salexhub.ai with the subject “Subprocessor notifications”.
1Infrastructure
Always engaged. These hold or transmit workspace data as part of running the platform.
| Subprocessor | Purpose | Data processed | Processing location |
|---|---|---|---|
| Vercel Inc. (United States) | Application and website hosting, edge routing, build and delivery | All data in transit through the application; request metadata and logs | Global edge network; requests served from regions including Frankfurt, Dubai and Washington, D.C. |
| Neon Inc. (United States) | Managed PostgreSQL — the primary datastore | All workspace records and personal data stored in the product | European Union (Frankfurt, Germany), on Amazon Web Services |
| Cloudflare, Inc. (United States) | Object storage (R2) for files, attachments and generated documents | Uploaded files, attachments, generated PDFs and their metadata | European Union |
| Amazon Web Services, Inc. (United States) | Underlying data-centre infrastructure for the managed database | As above, at the infrastructure layer | European Union (Frankfurt, Germany) |
2AI model providers
Engaged when a customer uses AI features. Each provider below is contractually barred from training its models on data we send on a customer's behalf. Which provider serves a request depends on the deployment's configuration and, for enterprise customers, on the key they supply.
| Subprocessor | Purpose | Data processed | Processing location |
|---|---|---|---|
| Anthropic PBC (United States) | Default model provider for assistant, agent, drafting and analysis features | Prompt content: the instruction, the records in scope, retrieved documents, and prior turns of the conversation | United States |
| Vercel Inc. (AI Gateway) (United States) | Model routing and embedding generation for search over workspace content, where enabled | Prompt content as above; text submitted for embedding | United States |
| Google LLC (United States) | Alternative model provider, where a deployment or customer selects it | Prompt content as above | United States |
| OpenAI, L.L.C. (United States) | Alternative model provider, where a deployment or customer selects it | Prompt content as above | United States |
3Payments and communications
| Subprocessor | Purpose | Data processed | Processing location |
|---|---|---|---|
| Stripe, Inc. (United States) | Payment processing for credit purchases and subscriptions | Billing contact details, payment method data (held by Stripe, never by us), transaction records | United States and European Union |
| Resend (Plus Five Five, Inc.) (United States) | Delivery of platform email — invitations, password resets, notifications — where configured as the platform sender | Recipient address, sender, subject and message content of platform email | United States and European Union |
4What we deliberately do not use
Stated because their absence is a design decision, and because a security questionnaire always asks:
- No advertising or marketing trackers on our website or in the application — no advertising networks, no third-party analytics, no session-replay tooling, no third-party font or script CDNs.
- No data broker or enrichment vendor receives customer data.
- No observability vendor currently receives production telemetry. The platform can export traces and metrics over OpenTelemetry, and its instrumentation is built to carry identifiers and timings but never message bodies, prompt text or field values; if we engage a vendor for this, it will appear here first.
- No offshore support outsourcing. Support is handled by our own personnel.
5Changes and objections
We update this page before a new subprocessor begins processing. Customers may object on reasonable data-protection grounds within thirty (30) days of notice, under section 6 of the DPA; if we cannot resolve the objection, the customer may terminate the affected part of the Service and receive a pro-rata refund for the unused period.
We may replace a subprocessor without notice where necessary to address a security incident or the failure of a provider, and will update this page as soon as practicable afterwards.