Where your data sits, and who can reach it.
Every statement below describes something that is in the product today. Where a measure belongs to a provider rather than to us, the provider is named and linked. Where something is not held, this page says so.
Last updated: 23 August 2026
Where your data lives
- The CRM app, the Contracts app and this website run as Vercel functions in London, region lhr1.
- Your records are held in Neon Postgres in AWS eu-west-2, which is London.
- Uploaded contracts and record attachments are kept in Vercel Blob in London, region lhr1, byte for byte, behind the app's own sign-in.
- Every request reaches the apps over HTTPS. All three deployments send a Strict-Transport-Security header with a two-year policy that covers subdomains.
- Neon encrypts stored data at rest. That is the database provider's own measure, on their own platform. Neon states this.
- Backups and point-in-time restore are run by Neon, in the same region as the database. The restore window on our plan is six hours. Neon states this.
The three settings are set in three places: the function region in each deployment's configuration, the database region on the database project, the document region on the blob store. Moving one does not move the others, so they are stated apart.
Who can see what
- Sign-in runs inside the application against your workspace's own database, so no third party holds the accounts.
- Anyone can turn on two-factor sign-in with an authenticator app, and gets backup codes with it.
- Six built-in roles carry named scopes. On Pro and Enterprise, admins compose custom roles from the same grants.
- Every read and every write goes through one authorisation check, scoped to your workspace, before a record is returned or changed.
- Single sign-on through an OIDC identity provider and SCIM 2.0 provisioning are part of the Enterprise plan.
- A contract can be marked confidential or restricted, and then admins, the person who restricted it, and the roles and people named on the policy can open it.
- A stored AI reading is guarded again for each reader: the sources behind it are re-checked against that reader's access before the panel draws, and paper they cannot open is counted rather than shown.
The last one is the part that is easy to get wrong. An AI reading is stored once and read many times, often by people who joined the workspace after it was produced. Each time a panel draws, the sources under it are fetched for that reader, under that reader's access, so a reading cannot become a way to read paper somebody was not given.
Keeping the record
- Every change to a record is appended to an event ledger with the actor, the source and the time, so the workspace can be read as it stood on any past date.
- Every workspace keeps an access log an administrator can read on the settings page. The export downloads the newest 10,000 entries as CSV.
- An Article 30 record of processing activities is built from the workspace and downloads as markdown from the same page.
- Erasing a person tombstones their record, redacts their details from the ledger in place, and suppresses their email so a later import cannot bring them back.
- Retention policies dispose of contracts on a schedule you set, legal holds keep named paper out of it, and what has been disposed of is counted where you can see it.
- Contracts and their register export as a data room, as a streamed ZIP of the paper with the index beside it.
- An audit pack gathers one contract's duties, its evidence files and its register into a single file for whoever is asking.
- Integration credentials your workspace stores, such as a mailbox token or a vendor API key, are sealed with AES-256-GCM before they reach the database.
- Inbound webhooks are signature-verified and fail closed, so an unsigned or replayed request is rejected rather than processed.
These are yours to run: an administrator sets the policy, presses the export and reads the log, without asking us to do it for them.
How AI readings are made
- AI readings are produced by model calls addressed to the Vercel AI Gateway, which is where a deployment sends them unless it is configured with a provider key of its own.
- Anthropic models read the paper and write the drafts. Voyage AI's voyage-law-2 turns clauses into the vectors meaning search reads.
- Every reading carries the model that produced it and the version of the prompt that asked, in the same glance as the reading.
- Two readings quote your paper character for character and are refused whole if they cannot: the extraction that builds the register, and the evidence read that weighs a file against a duty.
- Each run records the tokens it billed. Money is worked out from those tokens when a figure is shown, so a price change does not rewrite what a run cost.
- We do not use your documents to train models. That is our own undertaking about what we do with your paper, and it is written into the data processing agreement.
What the model providers do with a request once it reaches them is set by their own terms, so this page does not restate those terms. It names which provider processes what, which is the part we can point at.
The measured side of this lives on the accuracy page, which publishes what the AI evals scored on a fixed set of invented contracts whose answers are known, and says so when no run has been published yet.
Sub-processors
The providers that process customer data on our behalf. Where a provider's processing region is set by their terms rather than by us, the table says that rather than guessing at a country.
| Provider | What it does | Where | Transfer basis |
|---|---|---|---|
| Vercel Inc., application hosting | Runs both apps and this website, and the AI Gateway model calls pass through. | Functions in lhr1, London. | No transfer. Processing stays in the United Kingdom. |
| Vercel Inc., Blob document store | Holds uploaded contracts and record attachments, byte for byte, in a private store. | lhr1, London. | No transfer. Processing stays in the United Kingdom. |
| Neon Inc. | The Postgres database that holds every workspace record. | aws-eu-west-2, London. | No transfer. Processing stays in the United Kingdom. |
| Anthropic PBC, reached through the Vercel AI Gateway | The models that read contracts, answer questions and draft. | Region per the sub-processor's terms. | Adequacy where it applies, otherwise the IDTA with the SCC addendum, under the provider's own data processing terms. |
| Voyage AI, reached through the Vercel AI Gateway | Clause embeddings, which is what meaning search reads. | Region per the sub-processor's terms. | Adequacy where it applies, otherwise the IDTA with the SCC addendum, under the provider's own data processing terms. |
| Resend Inc. | Product email, outbound and inbound capture. | Region per the sub-processor's terms. | Adequacy where it applies, otherwise the IDTA with the SCC addendum, under the provider's own data processing terms. |
| Stripe Payments Europe, Ltd. | Subscription billing and payment. | Ireland, with onward processing under Stripe's own terms. | UK adequacy regulations for the EEA. |
| DocuSign, Inc. (optional) | Electronic signature. | Region per the sub-processor's terms. | Adequacy where it applies, otherwise the IDTA with the SCC addendum, under the provider's own data processing terms. |
| Google LLC (optional) | Reads and sends mail on a connected Gmail mailbox, and reads calendar events, for the account you connect. | Region per the sub-processor's terms. | Adequacy where it applies, otherwise the IDTA with the SCC addendum, under the provider's own data processing terms. |
| Microsoft Corporation (optional) | Reads and sends mail on a connected Microsoft 365 mailbox, and reads calendar events, for the account you connect. | Region per the sub-processor's terms. | Adequacy where it applies, otherwise the IDTA with the SCC addendum, under the provider's own data processing terms. |
| Slack Technologies, LLC (optional) | Posts notifications to the channel your incoming webhook points at. | Region per the sub-processor's terms. | Adequacy where it applies, otherwise the IDTA with the SCC addendum, under the provider's own data processing terms. |
| Apollo.io and ZoomInfo (optional) | Enrichment, on the account and API key your workspace supplies. | Region per the sub-processor's terms. | Adequacy where it applies, otherwise the IDTA with the SCC addendum, under the provider's own data processing terms. |
The rows marked optional are reached only when your workspace connects them, using the account and credentials you supply.
We give workspace administrators at least 30 days' notice by email before we add a provider that will handle your data.
The data processing agreement carries this list as Annex C, with the transfer basis for each provider, and sets out what happens if you object.
Recipients that are not sub-processors
Places a request goes that hold nothing of yours as a result. They are listed because a reader doing diligence wants the whole picture, and because what leaves is worth stating.
| Recipient | What we send | Why it is not a processor |
|---|---|---|
| Companies House | A company name or company number. No customer documents and no personal data. | A public register we look a company up in. They decide what their register holds, not us, so they are a controller of their own data rather than a processor of yours. |
| HMRC and the EU VIES service | A VAT registration number. No customer documents and no personal data. | Public VAT checks. They answer whether a number is valid; they hold nothing of yours as a result. |
| The European Central Bank | Nothing. We fetch their published daily exchange rates. | A one-way download of public reference rates, so no data of yours is involved at all. |
| Whatever your outbound webhooks point at | The signed event payload you subscribed to, to the URL your workspace entered. | You choose the destination, so that recipient is yours rather than one of ours. Zapier, Make, n8n and your own systems all arrive this way. |
Certifications
crmSpace holds no SOC 2 report and no ISO 27001 certificate today, and there is none to send.
What we can give you is this page, the data processing agreement, the sub-processor list, and the accuracy page, which prints whatever the last measured run of the AI evals produced and says so when there has been none.
If your procurement process needs a certified report, tell us early and we will say plainly whether we can meet the requirement rather than working around the question.
Report a concern
Email connect@crmspace.ai with enough detail to reproduce what you found. Good-faith research is welcome where it stays within the law and leaves other people's data alone. We reply to a security report within one UK business day, and we keep you posted while we work on it.
For a question about your own workspace's data rather than a vulnerability, the same address reaches us, and the data processing agreement sets out what we do when you ask.