Suppliers and Subprocessors

This page lists key suppliers and subprocessors used by Sales Triage to deliver its services.

The list should be kept current whenever suppliers are added, removed or materially changed.

How to Read This Page

Not every provider is used for every client, every feature or every account.

Some providers are used only when a specific feature is enabled, such as AI assistance, email connectivity, payment processing, enrichment, company research or video messaging.

Where Sales Triage acts as a processor, relevant subprocessors are used to provide the service on behalf of the client.

Our Suppliers and Subprocessors

The list below is maintained in code and is the same list shown on our Privacy Policy, so the two cannot drift apart. It includes our AI providers, the services used for specific features (email and calendar, payments, enrichment, company research, video messaging), and the infrastructure that hosts and backs up the platform (our UK host and our UK offsite backup store). When a provider is added, removed or materially changed, this list updates in both places at once.

Each entry states that supplier's role, because it decides what paperwork applies. A processor handles data on our instructions and needs a data processing agreement with us. An independent controller decides its own purposes and answers for the data directly, so a processing agreement with us is not the applicable instrument - GoCardless says this of itself, given its regulated role in payments. A public data source is a register we read, such as Companies House, which processes nothing on our behalf. Where you see no agreement listed against one of the latter two, that is the correct position rather than a gap.

For each provider the list also records, where we have established it, how a transfer of personal data out of the United Kingdom is safeguarded and a link to that provider's data processing agreement. We are working through the remaining providers. Where a safeguard is not yet recorded, the entry says nothing rather than implying one is in place - an incomplete register shown honestly is more use to you than a complete-looking one.

Anthropic

Their role: A processor: they handle data only on our instructions, under a data processing agreement with us.
What we use them for: Powers our AI features - drafting emails, analysing meeting transcripts, and generating playbooks and reports.
What we share with them: The content you put into AI features, which can include messages, meeting transcripts, and CRM notes.
Where they process data: United States
How transfers out of the UK are safeguarded: UK Addendum to the EU SCCs, incorporated at Schedule 3 of the Anthropic DPA.
Data processing agreement: View the agreement

Apollo

Their role: A processor: they handle data only on our instructions, under a data processing agreement with us.
What we use them for: An alternative provider for discovering and enriching the prospects you choose to research.
What we share with them: Contact identifiers such as name, company, and work email used to retrieve professional information.
Where they process data: United States
How transfers out of the UK are safeguarded: UK Transfer Addendum (the ICO IDTA of 21 March 2022), named in the Apollo DPA, which is incorporated into their terms of service.
Data processing agreement: View the agreement

Bunny.net

Their role: A processor: they handle data only on our instructions, under a data processing agreement with us.
What we use them for: Hosts and streams the video messages you record in the platform.
What we share with them: The video and audio you record, along with video titles and thumbnail images.
Where they process data: United Kingdom and European Union (storage in London and Frankfurt, with EU-only delivery routing).
How transfers out of the UK are safeguarded: Storage is pinned to London and Frankfurt. The UK leg is domestic, and the Frankfurt leg is a transfer to the EEA, which the UK adequacy regulations cover, so no IDTA or UK Addendum is needed. That matters because the signed DPA names no instrument of its own: it instead treats the account's region settings as our documented instruction (sections 3 and 9), while section 4.6 reserves processing 'from anywhere in the world'. The region setting is therefore the safeguard, and changing it would leave global processing with nothing behind it.

Companies House

Their role: A public data source: we read information they publish. They do not process anything on our behalf.
What we use them for: Looks up UK company information when you research and add prospects.
What we share with them: The company names and registration numbers you search for.
Where they process data: United Kingdom
How transfers out of the UK are safeguarded: United Kingdom only - no restricted transfer.

Exa

Their role: A processor: they handle data only on our instructions, under a data processing agreement with us.
What we use them for: An alternative provider for discovering companies and searching news when you research prospects.
What we share with them: The company names, search terms, and ideal-prospect criteria used to find companies and relevant news.
Where they process data: United States
How transfers out of the UK are safeguarded: UK IDTA to the EU SCCs (version B.1.0), named in the Exa DPA, which is incorporated into their terms of service.
Data processing agreement: View the agreement

Fasthosts

Their role: A processor: they handle data only on our instructions, under a data processing agreement with us.
What we use them for: Provides the UK virtual server that hosts the application and database during beta.
What we share with them: All platform data is hosted on this server, including the records and notes you store.
Where they process data: United Kingdom
How transfers out of the UK are safeguarded: United Kingdom only - no restricted transfer.
Data processing agreement: View the agreement

GoCardless

Their role: An independent controller: they decide their own purposes for the data, so they answer for it directly rather than processing it on our instructions.
What we use them for: Collects payment by Direct Debit for invoices raised through Xero.
What we share with them: Your name, email address, billing address, bank account details, and the invoices collected against your account.
Where they process data: United Kingdom and European Union
How transfers out of the UK are safeguarded: United Kingdom and European Economic Area processing, relied on under adequacy. GoCardless is an independent controller, so no Article 28 transfer instrument applies between us.

Lusha

Their role: A processor: they handle data only on our instructions, under a data processing agreement with us.
What we use them for: An alternative provider for enriching the prospect and contact records you choose to research.
What we share with them: Contact identifiers such as name, company, and work email used to retrieve professional information.
Where they process data: United States and European Union
How transfers out of the UK are safeguarded: UK IDTA to the EU SCCs (version B.1.0), named in the Lusha DPA, which is incorporated into the master services agreement.
Data processing agreement: View the agreement

Microsoft OneDrive

Their role: A processor: they handle data only on our instructions, under a data processing agreement with us.
What we use them for: Stores offsite backup copies of the platform.
What we share with them: Backup copies of the platform database, which contain the data you store in the platform.
Where they process data: United Kingdom
How transfers out of the UK are safeguarded: IDTA implemented by Microsoft, per the Microsoft Products and Services Data Protection Addendum, which applies automatically to a Microsoft 365 business tenant.
Data processing agreement: View the agreement

Nylas

Their role: A processor: they handle data only on our instructions, under a data processing agreement with us.
What we use them for: Connects your email inbox and calendar so you can send messages and manage meetings from inside the app, and powers the meeting notetaker that records and transcribes online meetings.
What we share with them: Email content, calendar events, and contact details from the inbox you connect, and the audio recording and transcript of meetings the notetaker joins.
Where they process data: United States and European Union
How transfers out of the UK are safeguarded: UK Extension to the EU-U.S. Data Privacy Framework (the UK-US Data Bridge), which Nylas is certified under. A valid mechanism under the UK adequacy regulations in force since 12 October 2023, so no IDTA or UK Addendum is required. Certification must be re-checked at each annual recertification, since lapsing would remove the safeguard.

OpenAI

Their role: A processor: they handle data only on our instructions, under a data processing agreement with us.
What we use them for: An alternative AI provider for the same drafting, analysis, and generation features, and transcribes recorded calls to text.
What we share with them: The content you put into AI features, which can include messages, meeting transcripts, and CRM notes, and the audio of recorded calls, which is transcribed to text.
Where they process data: United States
How transfers out of the UK are safeguarded: UK Addendum to the EU SCCs, defined and incorporated in the OpenAI DPA.
Data processing agreement: View the agreement

Stripe

Their role: Both, depending on what they are doing: they follow our instructions for part of it, and decide their own purposes for the rest - a payment provider deciding how to screen a card payment for fraud, for example.
What we use them for: Takes card payment against an invoice. Our Stripe account is connected to Xero, so the "Pay now" link on an invoice is processed by Stripe.
What we share with them: The payer's name and email address, billing address, the amount and reference of the invoice being paid, and the card details entered to pay it. We never see or hold the full card number.
Where they process data: United States and European Union
How transfers out of the UK are safeguarded: UK International Data Transfer Addendum, via the Data Transfers Addendum incorporated into the Stripe DPA.
Data processing agreement: View the agreement

Tavily

Their role: A processor: they handle data only on our instructions, under a data processing agreement with us.
What we use them for: Searches the web for company news and context when you research prospects.
What we share with them: The company names and search terms used to find relevant news.
Where they process data: United States

Telnyx

Their role: A processor: they handle data only on our instructions, under a data processing agreement with us.
What we use them for: Powers the Calling and SMS add-on - in-browser calling, call recording, and text messaging.
What we share with them: The phone numbers you dial or text, the content of text messages, and the audio recordings of calls, which are recorded for training and quality. Recordings are stored in a Telnyx-managed store whose region is not customer-selectable.
Where they process data: United States and European Union
How transfers out of the UK are safeguarded: UK International Data Transfer Addendum to the EU SCCs, at Schedule 3 of the Telnyx DPA.
Data processing agreement: View the agreement

Xero

Their role: A processor: they handle data only on our instructions, under a data processing agreement with us.
What we use them for: Raises and sends your invoices, and holds them as our accounting records. Card payment against an invoice is passed to the payment service connected to Xero (Stripe); Direct Debit collection is passed to GoCardless.
What we share with them: Your organisation name, billing contact email, billing address, VAT number where you have given one, and the invoices raised against your account.
Where they process data: New Zealand, Australia, United States and European Union
How transfers out of the UK are safeguarded: UK Addendum to the EU SCCs, named in the Xero data processing terms; New Zealand relied on under adequacy.
Data processing agreement: View the agreement

Prospecting and Enrichment Providers

Prospecting and enrichment providers may be used by Sales Triage or by clients depending on the feature, configuration and data source.

Where a client imports or enriches data using third-party tools, the client remains responsible for having a lawful basis for obtaining and using that data.

AI Providers

AI providers are used through commercial API services.

Client content submitted through AI features is not used to train AI models under the commercial API terms used by Sales Triage.

Supplier Change Process

When a supplier or subprocessor is added, removed or materially changed, Sales Triage should:

update this page
update the Privacy Policy if required
update AI and security pages if affected
add an entry to the changelog
notify affected clients where required by contract or law