Subprocessors
Last updated 1 September 2026
These are the third-party services Saral uses to provide the platform. Each is bound by a data processing agreement, processes only what its purpose requires, and appears here before it ever touches customer data. Material changes to this list are announced by email 30 days in advance — subscribers may object on reasonable data-protection grounds.
| Service | Purpose | Data involved | Region |
|---|---|---|---|
| Supabase (on AWS) | Primary database, authentication, file storage | All application data | EU (Ireland, eu-west-1) |
| Vercel | Application hosting and delivery; privacy-friendly, cookieless page analytics | All data in transit through the app | Global edge; functions EU/US |
| Xero | Your accounting platform — the system Saral connects to on your instruction | Accounting data you sync | Per Xero's own hosting |
| Anthropic | AI document extraction (e.g. reading supplier invoices you submit) | Documents submitted for processing; no training on your data | US (contractual safeguards) |
| GoCardless | Direct Debit collection of Saral subscription fees | Billing contact + mandate; bank details are held by GoCardless, never by Saral | UK |
| Upstash | Rate limiting and short-lived operational caches | Transient keys/counters; no business records | EU |
| Resend | Transactional email (invites, notifications, statements) | Recipient addresses + email content | US/EU (contractual safeguards) |
| Microsoft (Graph API) | Optional: mailbox ingestion for document processing; OneDrive/SharePoint document storage | Only for customers who connect Microsoft 365 | Your Microsoft tenant's region |
| HMRC APIs | Optional: VAT and CIS filings/queries you initiate | The figures and references those filings require | UK |
| Companies House API | Optional enrichment from the public register | Public company data only | UK |