Subprocessors

Last updated 17 October 2026

These are the third-party services that process personal data on Saral’s behalf to provide the platform. Each is bound by a data processing agreement, processes only what its purpose requires, and appears here before it ever touches customer data. Where a service processes outside the UK/EEA, transfers rest on adequacy regulations or the UK Addendum to the standard contractual clauses. Rows marked “optional” receive nothing until a subscriber (or, for platform services, Saral) switches them on. Material changes to this list are announced by email 30 days in advance — subscribers may object on reasonable data-protection grounds. The controls around these services are described on /trust; how data is handled is in the privacy notice.

Service	Purpose	Data involved	Region
Supabase, Inc. (on AWS)	Primary database, authentication (passwords, two-step factors, sessions) and private file storage	All application data, every subscriber	EU — AWS eu-west-1 (Ireland)
Vercel, Inc.	Hosts and serves the application (server functions, edge, CDN); cookieless page analytics and performance timings	All data in transit through the app; analytics receives page paths and anonymised timings only — no cookie, no user identifier	Server functions pinned to Dublin (dub1); CDN/edge global
Anthropic, PBC	AI reading of documents and text: supplier invoices, receipts, statements, tender documents, worker certificates and identity documents when uploaded, Email Hub triage and summaries, drafted commentary and letters	The content of what is read — documents and emails, including names, addresses, bank details printed on invoices, and identity documents where the subscriber uploads them. No training on customer content under Anthropic's commercial terms	United States (contractual safeguards)
Microsoft — Azure AI Faceoptional	Face check-in on site: liveness detection and a one-to-one comparison of the live face with the worker's profile photo; walk-up identification where enabled; comparison of the right-to-work document photo with the profile photo. Biometric (special category) data, on the worker's explicit consent with a card alternative	Face images sent for detection and comparison; where identification is enabled, a face template per enrolled worker held in a group keyed to the subscriber's account	UK — Azure UK South (London)
Microsoft — Azure Key Vault	Holds the non-exportable, HSM-backed private key for the Saral Sign platform seal and signs a document digest	None — it receives a hash, never the document or a name. Listed because it is in the signing chain	UK — Azure UK South (London)
Microsoft — Graph API (Email Hub, BillScan mailbox, Saral Sign OneDrive, Microsoft sign-in)optional	Reads and sends mail from mailboxes the subscriber connects; backs up completed signed PDFs to the creator's OneDrive; “Sign in with Microsoft”. Processing happens in the subscriber's own Microsoft 365 tenant	Email content, senders, recipients and attachments of connected mailboxes; signed PDFs written to OneDrive. OAuth tokens are encrypted at rest	The subscriber's Microsoft 365 tenant region
Microsoft — SharePoint (read-only)optional	Nightly read-only sweeps of folders the subscriber links (projects, tenders, compliance documents, training certificates, fleet documents, policies, lettings). Saral never writes to SharePoint	Document contents and folder metadata from the linked folders	The subscriber's Microsoft 365 tenant region
Resend, Inc.	Transactional email: invites, sign-in links, notifications, statements, reminders, digests, Worker Pool and hiring mail	Recipient name and address, subject and body (which can include a worker's or supplier's name, amounts and links)	US-based provider; email sent and data held in the EU (Ireland, eu-west-1)
Twilio, Inc.optional	SMS and WhatsApp from one platform number: Worker Pool call-ups and nudges, the one-time code on the public apply form, STOP/START opt-out handling. Nothing is sent until it is switched on	Mobile number, first name, company name and the message text	US-based provider; messages to UK numbers
Functional Software, Inc. (Sentry)	Crash and error monitoring for the server, edge and browser. Request bodies, cookies, query strings and token-bearing path segments are stripped before an event leaves the process	Stack traces, route names and the error message. No user identifier, IP address or request body by configuration; a name inside an error message could still reach Sentry	EU (Germany)
Upstash, Inc.optional	Distributed rate-limit counters and short-lived locks. Falls back to in-memory counters when not configured	Transient keys: a hashed IP address or user id plus a counter. No business records	EU (Ireland)
Google LLC — Firebase Cloud Messaging	Push notifications to the native app. Web push to browsers goes through each browser vendor's push service (Google, Apple, Mozilla)	Device push token, notification title and body (for example a check-in reminder or a leave decision)	Global (Google)
Google LLC — Fonts	Typefaces. The app's fonts are fetched at build time and self-hosted; the signature pad's typed-signature fonts load from fonts.googleapis.com in the signer's browser	IP address and browser details of the person on the signature screen; nothing else	Global (Google)
GoCardless Ltd	Direct Debit collection of Saral's own subscription fees (Saral is the controller here). The mandate is set up on GoCardless's hosted pages	Billing contact name and email; mandate and payment references. Bank details are held by GoCardless, never by Saral	UK
Meta Platforms (Facebook Page / Instagram)optional	Optional auto-posting of Worker Pool vacancies to the subscriber's own Facebook Page and Instagram account. Only the vacancy text and image are posted	No personal data is sent — vacancies only. Listed because a token for the subscriber's social accounts is held, encrypted at rest	Global (Meta)

Independent recipients

Public authorities, open-data sources and a subscriber’s own systems that receive data because the subscriber asks Saral to send it. They are controllers in their own right, not Saral’s processors; they are listed so the record is complete. Saral never files a return with HMRC or any other authority.

Recipient	Why data goes there	Data sent	Who decides
Xero Limited	The subscriber's accounting platform. Saral reads the organisations the subscriber connects and writes bills, invoices, journals and contacts back on the subscriber's instruction	Contacts (suppliers, customers, workers as suppliers), invoice and payment data, bank transactions, attachments, employee cost allocations. OAuth tokens encrypted at rest	Subscriber (connects and disconnects; scopes approved at consent)
HMRC	VAT (MTD) obligations, liabilities and payments; VAT number checks; CIS subcontractor verification. Saral never files a return	VAT registration numbers; for CIS verification the subcontractor's name, UTR, NI or company number and address, as the HMRC service requires	Subscriber (connects HMRC; triggers a verification)
UK Visas and Immigration (Home Office)	Right-to-work share-code check	Share code and date of birth; the response is stored for the audit record	Subscriber (the employer's own Home Office access)
Companies House	Public register lookups (company structure, officers, filing documents)	Searches by company name or number; public officer data is read, not sent	Saral platform key; the subscriber chooses the companies
DVLA (Access to Driver Data) / DVSA (MOT history)	Driver licence checks with the driver's recorded consent; vehicle MOT history. Switched on per subscriber with the subscriber's own credential	Driving licence number, name and date of birth (DVLA); vehicle registration (MOT)	Subscriber
Open-data and reference sources (EPC register, Ordnance Survey, Met Office, postcodes.io, Land Registry, Environment Agency, planning.data.gov.uk, ONS, Bank of England, Find a Tender / Contracts Finder, Gazette, HSE notices, what3words)	Site, property, price and procurement facts	Addresses and postcodes of sites and properties; no person is named in a request	Saral (platform keys) / subscriber (which site)
The subscriber's own Microsoft 365 tenant	Data read from and written to the subscriber's mailboxes, SharePoint and OneDrive stays under the subscriber's own Microsoft agreement	As the Microsoft Graph and SharePoint rows above	Subscriber

Subprocessors

Last updated 17 October 2026

Service	Purpose	Data involved	Region
Supabase, Inc. (on AWS)	Primary database, authentication (passwords, two-step factors, sessions) and private file storage	All application data, every subscriber	EU — AWS eu-west-1 (Ireland)
Vercel, Inc.	Hosts and serves the application (server functions, edge, CDN); cookieless page analytics and performance timings	All data in transit through the app; analytics receives page paths and anonymised timings only — no cookie, no user identifier	Server functions pinned to Dublin (dub1); CDN/edge global
Anthropic, PBC	AI reading of documents and text: supplier invoices, receipts, statements, tender documents, worker certificates and identity documents when uploaded, Email Hub triage and summaries, drafted commentary and letters	The content of what is read — documents and emails, including names, addresses, bank details printed on invoices, and identity documents where the subscriber uploads them. No training on customer content under Anthropic's commercial terms	United States (contractual safeguards)
Microsoft — Azure AI Faceoptional	Face check-in on site: liveness detection and a one-to-one comparison of the live face with the worker's profile photo; walk-up identification where enabled; comparison of the right-to-work document photo with the profile photo. Biometric (special category) data, on the worker's explicit consent with a card alternative	Face images sent for detection and comparison; where identification is enabled, a face template per enrolled worker held in a group keyed to the subscriber's account	UK — Azure UK South (London)
Microsoft — Azure Key Vault	Holds the non-exportable, HSM-backed private key for the Saral Sign platform seal and signs a document digest	None — it receives a hash, never the document or a name. Listed because it is in the signing chain	UK — Azure UK South (London)
Microsoft — Graph API (Email Hub, BillScan mailbox, Saral Sign OneDrive, Microsoft sign-in)optional	Reads and sends mail from mailboxes the subscriber connects; backs up completed signed PDFs to the creator's OneDrive; “Sign in with Microsoft”. Processing happens in the subscriber's own Microsoft 365 tenant	Email content, senders, recipients and attachments of connected mailboxes; signed PDFs written to OneDrive. OAuth tokens are encrypted at rest	The subscriber's Microsoft 365 tenant region
Microsoft — SharePoint (read-only)optional	Nightly read-only sweeps of folders the subscriber links (projects, tenders, compliance documents, training certificates, fleet documents, policies, lettings). Saral never writes to SharePoint	Document contents and folder metadata from the linked folders	The subscriber's Microsoft 365 tenant region
Resend, Inc.	Transactional email: invites, sign-in links, notifications, statements, reminders, digests, Worker Pool and hiring mail	Recipient name and address, subject and body (which can include a worker's or supplier's name, amounts and links)	US-based provider; email sent and data held in the EU (Ireland, eu-west-1)
Twilio, Inc.optional	SMS and WhatsApp from one platform number: Worker Pool call-ups and nudges, the one-time code on the public apply form, STOP/START opt-out handling. Nothing is sent until it is switched on	Mobile number, first name, company name and the message text	US-based provider; messages to UK numbers
Functional Software, Inc. (Sentry)	Crash and error monitoring for the server, edge and browser. Request bodies, cookies, query strings and token-bearing path segments are stripped before an event leaves the process	Stack traces, route names and the error message. No user identifier, IP address or request body by configuration; a name inside an error message could still reach Sentry	EU (Germany)
Upstash, Inc.optional	Distributed rate-limit counters and short-lived locks. Falls back to in-memory counters when not configured	Transient keys: a hashed IP address or user id plus a counter. No business records	EU (Ireland)
Google LLC — Firebase Cloud Messaging	Push notifications to the native app. Web push to browsers goes through each browser vendor's push service (Google, Apple, Mozilla)	Device push token, notification title and body (for example a check-in reminder or a leave decision)	Global (Google)
Google LLC — Fonts	Typefaces. The app's fonts are fetched at build time and self-hosted; the signature pad's typed-signature fonts load from fonts.googleapis.com in the signer's browser	IP address and browser details of the person on the signature screen; nothing else	Global (Google)
GoCardless Ltd	Direct Debit collection of Saral's own subscription fees (Saral is the controller here). The mandate is set up on GoCardless's hosted pages	Billing contact name and email; mandate and payment references. Bank details are held by GoCardless, never by Saral	UK
Meta Platforms (Facebook Page / Instagram)optional	Optional auto-posting of Worker Pool vacancies to the subscriber's own Facebook Page and Instagram account. Only the vacancy text and image are posted	No personal data is sent — vacancies only. Listed because a token for the subscriber's social accounts is held, encrypted at rest	Global (Meta)

Independent recipients

Recipient	Why data goes there	Data sent	Who decides
Xero Limited	The subscriber's accounting platform. Saral reads the organisations the subscriber connects and writes bills, invoices, journals and contacts back on the subscriber's instruction	Contacts (suppliers, customers, workers as suppliers), invoice and payment data, bank transactions, attachments, employee cost allocations. OAuth tokens encrypted at rest	Subscriber (connects and disconnects; scopes approved at consent)
HMRC	VAT (MTD) obligations, liabilities and payments; VAT number checks; CIS subcontractor verification. Saral never files a return	VAT registration numbers; for CIS verification the subcontractor's name, UTR, NI or company number and address, as the HMRC service requires	Subscriber (connects HMRC; triggers a verification)
UK Visas and Immigration (Home Office)	Right-to-work share-code check	Share code and date of birth; the response is stored for the audit record	Subscriber (the employer's own Home Office access)
Companies House	Public register lookups (company structure, officers, filing documents)	Searches by company name or number; public officer data is read, not sent	Saral platform key; the subscriber chooses the companies
DVLA (Access to Driver Data) / DVSA (MOT history)	Driver licence checks with the driver's recorded consent; vehicle MOT history. Switched on per subscriber with the subscriber's own credential	Driving licence number, name and date of birth (DVLA); vehicle registration (MOT)	Subscriber
Open-data and reference sources (EPC register, Ordnance Survey, Met Office, postcodes.io, Land Registry, Environment Agency, planning.data.gov.uk, ONS, Bank of England, Find a Tender / Contracts Finder, Gazette, HSE notices, what3words)	Site, property, price and procurement facts	Addresses and postcodes of sites and properties; no person is named in a request	Saral (platform keys) / subscriber (which site)
The subscriber's own Microsoft 365 tenant	Data read from and written to the subscriber's mailboxes, SharePoint and OneDrive stays under the subscriber's own Microsoft agreement	As the Microsoft Graph and SharePoint rows above	Subscriber