subprocessors
Who Sentrely shares your data with.
A subprocessor is any third-party that processes customer data on Sentrely's behalf. Each one is risk-classified, contractually bound, and reviewed quarterly. We notify customers 30+ days before adding a Tier 1 (high-risk) subprocessor.
classification
Tier 1 — High risk
Processes customer PII or RESTRICTED data. Annual risk assessment. DPA required.
Tier 2 — Medium risk
Processes operator data only (Sentrely\'s own employees, billing, code). DPA required.
Tier 3 — Low risk
Operational telemetry or public assets only. No customer PII exposure.
Tier 1 — High risk
Amazon Web Services
Tier 1Service: Compute, storage, database, KMS, networking, IAM
Data: All customer data (encrypted at rest with AWS KMS)
Region: us-east-1 (primary); us-west-2 (DR replica)
Anthropic
Tier 1Service: Claude foundation-model inference
Data: Agent prompts + responses, at the customer's direction. PII redacted in storage chokepoint before reaching prompts.
Region: United States
Slack
Tier 1Service: Workspace messaging (agent → operator notifications)
Data: Notification text, channel names, mentioned user emails
Region: United States
GoHighLevel
Tier 1Service: CRM integration (contacts, conversations, opportunities)
Data: Customer CRM data the customer chose to expose to Sentrely
Region: United States
Resend
Tier 1Service: Transactional email (signup, password reset, lead-form replies)
Data: Recipient email + email body
Region: United States
Tier 2 — Medium risk
Stripe
Tier 2Service: Payment processing for Sentrely's own subscriptions
Data: Billing info; card details handled by Stripe directly, never on Sentrely servers
Region: United States
Bitbucket / Atlassian
Tier 2Service: Source code hosting
Data: Source code only (no customer data)
Region: United States
GitHub
Tier 2Service: Source code hosting + CI
Data: Source code only (no customer data)
Region: United States
Google (Cloud + Gmail OAuth)
Tier 2Service: Gmail integration OAuth flow; Google Fonts CDN
Data: OAuth tokens + connected Gmail address
Region: Global
Microsoft (Azure AD + Outlook OAuth)
Tier 2Service: Outlook integration OAuth flow
Data: OAuth tokens + connected Outlook address
Region: Global
Telegram
Tier 2Service: Bot messaging (operator notifications + approvals)
Data: Notification text + operator's Telegram user_id
Region: Cloud Telegram (Telegram-managed)
Meta (Facebook / Instagram / WhatsApp)
Tier 2Service: Ads + Lead Ads integration
Data: Ad campaign metadata + lead-ad submissions (customer-driven)
Region: Global
Tier 3 — Low risk
Reddit Ads
Tier 3Service: Reddit advertising integration
Data: Ad campaign metadata only — no customer PII
Region: Global
jsDelivr
Tier 3Service: Public CDN for static logo SVGs
Data: None — anonymous browser fetches of public icons
Region: Global
Apple (iCloud Mail SMTP/IMAP)
Tier 3Service: iCloud Mail driver; app-password setup only
Data: None server-side; user-supplied app password stored in customer's workspace KMS-wrapped storage
Region: Global
change notification
When Sentrely adds a new Tier 1 subprocessor, existing customers are notified at least 30 days before the change takes effect, with the option to terminate the contract. Notification goes out via email to the billing contact on file and a banner in the dashboard.
Last reviewed: 2026-05-22 · Next review: 2026-08-22 · Questions: security@sentrely.com