Sub-processors
Sub-processors of customer log data
| Sub-processor | Purpose | Location of processing | Safeguards |
|---|---|---|---|
| Amazon Web Services, Inc. | All hosting, storage and compute for the Service. | Storage and primary processing: UK (eu-west-2, London). For customers ingesting via AWS CloudFront, log records transit AWS US infrastructure (us-east-1) before storage in London. | AWS GDPR Data Processing Addendum; EU SCCs + UK Addendum; EU-US Data Privacy Framework participant. |
| Anthropic, PBC | Optional AI features only: the dashboard chat assistant and AI alert summaries. Receives queries and derived analytics results needed to answer them. | United States | Anthropic Commercial Terms & DPA (SCCs); API inputs/outputs not used for model training. These features can be switched off for an organisation on request. There is no control for this in the dashboard. While they are switched off, nothing from that organisation is sent to Anthropic, and the rest of the analytics keep working. |
| Cloudflare, Inc. | Runs the MCP server. Used only when you connect an MCP client: each tool call is forwarded to the Salience API, and the response (which can include log records) is returned to that client. The Worker does not store customer log records. | Cloudflare's network. The Worker is not pinned to one region. | The connection's API key is held for the session. OAuth tokens, and a short-lived note of whether a key is valid, are kept. Log records returned by a tool call are not. |
Service providers that never receive log data
| Provider | Purpose | Data involved |
|---|---|---|
| Stripe Payments Europe, Limited and Stripe Payments UK Limited (Stripe), with transfers to Stripe, LLC in the US | Subscription billing | Account owner name, email, payment details. No visitor log data. |
| Amazon SES (AWS) | Transactional email (alerts, invitations, notices) | Recipient email addresses and alert summaries you configure. No raw log data. |
| Google LLC | Search Console integration, only if you connect it | Google integration refresh tokens (encrypted with AWS KMS before storage in DynamoDB) and Search Console metrics fetched on your behalf. Subject to Google's API Services User Data Policy (Limited Use). |
| Microsoft Corporation (Microsoft Clarity) | Session analytics on salience.com and in the dashboard, only after analytics consent | How people use the site and the dashboard (pages, clicks and session recordings). No visitor server logs. We do not set a processing region; Microsoft does not state one in our configuration. |
Change log
Version 1.0, initial publication of this list.
Cloudflare (the MCP server) and Microsoft Clarity (analytics on salience.com and in the dashboard, only after analytics consent) added to this list.