Subprocessors
Subprocessors
The companies that process data on RelayLink's behalf, where they do it, and for what. The privacy policy summarises this list and the data processing addendum refers to it. Last updated 19 September 2026.
The list
| Company | What it does for us | What it can see | Where |
|---|---|---|---|
| Microsoft Corporation (Microsoft Azure) | Hosts the application, the database, the secrets store, the logs, the performance telemetry, and the documents you attach. | Everything the service stores, encrypted at rest with Microsoft's keys. Microsoft's staff do not have standing access to customer data under its own terms. | United States (Central US region; backups replicated to a second US region). |
| Mailgun Technologies, Inc. (part of Sinch) | Sends every email the service sends and receives every reply sent to it by email. | The address and name on each email, what a notification carries — the sender, the topic, the note, the question, the summary and the start of the message — each emailed reply in full, kept there for three days while we collect it, and delivery logs. We have not enabled open or click tracking. | United States. |
| Cloudflare, Inc. | Hosts the DNS zone for relaylink.ai. | The DNS lookup your network makes for the domain. No traffic, no content: every record is DNS-only, so web traffic goes straight to Azure and mail straight to Mailgun, never through Cloudflare. | Global (a DNS lookup is answered from the nearest location). |
| GitHub, Inc. (a Microsoft subsidiary) | Holds the source code and runs the deployment pipeline that builds the service and applies database schema changes. | The pipeline holds an identity that can read and write the database as well as change its structure, used for deployments only. No customer data is stored at GitHub; the service’s configuration there names the founders’ own addresses. | United States. |
| New Relic, Inc. | Not in use today. Would receive the performance telemetry and application logs that tell us which pages and endpoints are slow or failing, if we switched it on. | Nothing today. If switched on: request timings and endpoint shapes with any link token removed before they leave us, counts of which assistant tools were called, and log lines tested never to contain an address, a link token or a credential. No briefing content and no correspondence. | United States. |
| OpenAI, L.L.C. | Answers the assistant built into the account pages, where it is switched on and you use it; it is not yet switched on everywhere. It is not involved in anything else: a briefing you send, a reply you receive and every page you read work exactly the same whether or not you ever open it. | What you type to that assistant, and whatever it fetched from your account to answer you — which can include the content of briefings you have received. We ask OpenAI not to store the exchange, and it is not used to train models; OpenAI keeps its own abuse-monitoring logs for up to thirty days. Nothing is sent to them by anything other than the assistant. Searching by meaning, which would send text to OpenAI, is built and switched off. | United States. |
| Google LLC (Gmail) | Hosts the company mailbox that our contact address delivers to. | Mail anybody sends to our contact address, and the notices the service sends us when a support request arrives, which carry the requester’s address and the start of their message. | United States. |
| Stripe, Inc. | Not in use today. Would take payment for a Pro subscription and hold your card details, if checkout were switched on here. | Nothing today. If switched on: your name, email address and payment details, and which plan you subscribed to. We would never see or store your card details ourselves. | United States. |
Who is not on it, and why
- The assistant you connect — Claude, ChatGPT, Claude Code, an agent framework — is not our subprocessor. You chose it, you connected it, it acts for you, and you can disconnect it at any moment from your connections page. Its provider's terms govern what it does with what it reads; the privacy policy says so. That is the opposite of the assistant we host in your account pages, which runs on a provider we chose and is therefore on the list above.
- No card details are held anywhere today. Stripe is named above ahead of being switched on, so the notice below is never something we owe retroactively once a charge becomes possible.
- No visitor analytics, advertising, support-desk, chat-widget or marketing-email provider, because the service uses none. Nothing follows you between pages and no page carries a tracker. The telemetry provider above, when it is switched on, measures the service itself — how fast a page answered, whether it failed — not the people using it.
- Webhook receivers an account holder registers are not ours either: the account holder chose the address, and each receives only the envelope of that account’s own incoming briefings.
When the list changes
This page states the subprocessors in use as of general availability. From that date, we update it at least thirty days before a new subprocessor begins processing personal data, except where one has to be replaced urgently to keep the service secure or running, in which case we update it as soon as we can. An account holder who wants to be emailed about changes can ask at the address below; a business customer's rights to object are in section 6 of the data processing addendum. Microsoft and Mailgun process under data protection terms that include, for transfers from the EEA, the UK and Switzerland, the standard contractual clauses. Cloudflare and GitHub hold no customer data. For the terms that apply to OpenAI, Google and Stripe, write to us.
Contact
hello@relaylink.ai — the only channel we take them on. PillarStack LLC is in Richmond, Virginia, United States. The whole set of policies is listed at relaylink.ai/legal.