Salience

Trust, GDPR & Data Protection

The short version: your logs stay yours, and we process them only on your documented instructions under our Data Processing Agreement. Customer log data is stored in the UK (AWS London, eu-west-2) and processed there, except in the limited cases set out under International transfers below. This page is a summary written to be sent to your legal or compliance team. It is not legal advice, and the Data Processing Agreement governs.

You are the controllerWe act solely as your processor under our Data Processing Agreement (GDPR Art. 28), which applies automatically to every account, nothing to sign.
UK data residencyCustomer log data is stored in AWS eu-west-2 (London), with TLS-protected ingestion and APIs and encrypted S3, DynamoDB and Aurora storage. The query cache is not encrypted at rest; see the Security Overview. Some ingestion transit and the optional AI features involve the US, see Transfers.
No cookies, no bannerNothing runs in your visitors' browsers. No cookies, pixels or scripts, so no ePrivacy/PECR consent banner is triggered by Salience.
A recognised lawful basisGDPR Recital 49 expressly recognises network & information security monitoring as a legitimate interest. See our pre-filled LIA template.
Retention you controlPlan-tiered retention (30 days–2 years), traffic-class retention filters, and support for upstream PII exclusion (Vercel/Netlify).
No sale, no poolingWe never sell data, never use your logs for advertising, and never share one customer's data with another.

Why your lawyers will ask about IP addresses

IP addresses are personal data under GDPR (Recital 30; CJEU Breyer C-582/14). Your CDN or web server already records them in its access logs: Salience analyses that existing operational dataset on your behalf. The correct legal footing, and the one we operate on, is:

You (controller) already collect server logs as an unavoidable part of operating a website, with legitimate interests (security monitoring, fraud prevention, service integrity: Recitals 47 & 49) as the lawful basis. We (processor) analyse them strictly on your documented instructions under our DPA, which is incorporated into our Terms and applies from signup without any signature.

Common questions from legal & compliance teams

Where is the data processed and stored?
Stored in AWS London (eu-west-2). For customers who ingest via AWS CloudFront, log records transit AWS US infrastructure (us-east-1) momentarily before storage in London, covered by AWS's GDPR Data Processing Addendum and Standard Contractual Clauses. Full detail: sub-processor list.

Who are your sub-processors?
AWS (hosting), Anthropic (optional dashboard chat and AI alert summaries, switched off for an organisation on request, with no control in the dashboard), Cloudflare (the MCP server, only when a client is connected), Stripe (billing only; never sees log data), Google (only if you connect Search Console) and Microsoft Clarity (analytics on this site and in the dashboard, only after analytics consent). See the current list, including our 30-day advance-notice commitment.

Do you need our visitors' consent?
No consent banner is required for Salience: we place nothing on the visitor's device. Your lawful basis for the underlying log processing is legitimate interests, we provide a Legitimate Interests Assessment template your team can adapt and file.

What if we can't share full IP addresses?
Options today: (1) enable your platform's PII exclusion (Vercel and Netlify can strip IP and user-agent before anything is sent: Salience handles the reduced records gracefully); (2) use retention filters to store only bot/crawler traffic and discard human visitor records. An ingest-time IP-masking option is on our roadmap, ask us.

How long do you keep our data?
Per your plan (30 days to 2 years) and your configuration. On termination, data is deleted per the DPA (30 days, with backup purge within a further 35).

What happens in a breach?
We notify you without undue delay after becoming aware of a personal-data breach affecting your data, with the detail you need for your own Art. 33 assessment. See the DPA.

What security controls do you run?
Summarised in our security overview: encryption everywhere, hashed API keys, least-privilege IAM, per-customer data partitioning, point-in-time recovery on core stores, and more.

Are you SOC 2 certified?
Not yet, certification is on our roadmap. We run on AWS inherited controls and document our own measures honestly in the security overview.

CCPA/US clients?
We operate as a “service provider”, we process personal information only to provide the service, and do not sell or share it.

International transfers

Customer log data is stored and processed in the UK (AWS London, eu-west-2). Two paths involve the United States, and connecting an MCP client can send a tool response through Cloudflare outside the UK:

Ingestion transit. For customers who ingest via AWS CloudFront, log records pass through AWS US infrastructure (us-east-1) momentarily before storage in London. This is covered by AWS's GDPR Data Processing Addendum, the EU Standard Contractual Clauses with the UK Addendum, and AWS's participation in the EU-US Data Privacy Framework.

Optional AI features. The dashboard chat assistant and AI alert summaries send queries and the derived analytics results needed to answer them to Anthropic in the United States, under Anthropic's commercial terms and DPA (Standard Contractual Clauses). API inputs and outputs are not used for model training. These features can be switched off for an organisation on request. There is no control for this in the dashboard. While they are switched off, nothing from that organisation is sent to Anthropic, and the rest of the analytics keep working.

MCP server. When you connect an MCP client, the tool call and the API's response (which can include log records) pass through Cloudflare. The Worker does not store those records. If you do not use the MCP server, nothing is sent to Cloudflare.

No other customer log data leaves the UK. The safeguards for each transfer are listed against the relevant provider in the sub-processor list, and the contractual commitment is section 10 of the DPA.

The lawyer pack

Everything your counsel needs, in one place:

• Data Processing Agreement (GDPR Art. 28, applies automatically, countersigned copy on request)
• Sub-processor list
• Security overview (Art. 32 measures)
• Legitimate Interests Assessment template
• Privacy policy · Terms of service

Questions from your DPO or counsel? Email privacy@salience.com, we answer vendor-assessment questionnaires quickly.