Your data is hosted in the European Union (Frankfurt), encrypted, and isolated by the database itself. It is never sold or used to train AI. All external access goes through a key that you create and revoke, and every call is logged.
Where your data lives
The database, authentication and server functions are run by Supabase in the European Union, in Frankfurt. Traffic is encrypted (TLS), and data is encrypted at rest. The application pages are served by Vercel: they are code and styles only, no client data is stored there — your browser talks directly to the database.
Who can see it
- Isolation by the database, not by the screen. Every table applies a row-level security rule: a rep reads only their own portfolio, a manager what their scope opens up, and a workspace never sees another workspace — even by typing an address by hand.
- Two-factor authentication, each user's choice: once turned on, the database rules require the code at every sign-in; it can be turned off from one's profile.
- Permissions by role: administering, managing, assigning and approving prices are set per profile.
What leaves, and how to check
Data leaves your workspace only through one of these routes, all of them initiated by you:
- The API and AI assistants (Claude, ChatGPT, Perplexity, via the MCP protocol): only with a key created by the administrator, read-only by default, revocable in one click. SalesIro keeps only the hash of the key. Every call is logged — key, date, data, number of rows, result — in a log that the application does not allow anyone to edit or delete.
- Exports that you run (orders for the ERP, statements).
- Emails that you send (follow-up scenarios, order forms), via Mailjet.
- Dictation, if you use it: speech recognition is your browser's own, and the text is formatted by Anthropic before you approve it.
Sub-processors
| Provider | Role | Location | When |
|---|---|---|---|
| Supabase | Database, authentication, server functions | European Union (Frankfurt) | Always |
| Vercel | Hosting of the application pages (code, no client data) | Global delivery network | Always |
| Mailjet | Sending emails (scenarios, order forms, invitations) | European Union | If you send emails |
| Anthropic | Formatting of dictated visit reports (the text, not the audio) | United States | Only if structured dictation is used |
| Google or Apple | Browser speech recognition (Chrome, Safari) | Depends on the browser vendor | Only if you dictate |
Text sent to Anthropic leaves the European Union. If your policy forbids this, don't enable structured dictation: dictation remains available, saved as spoken.
Your rights and your data
- Full export through the application and the API.
- Deletion of the workspace and its data on request at the end of the subscription.
- Data processing agreement (Article 28 GDPR) provided on request.
- Unsubscribes from your email recipients honoured across your whole workspace, in one click.
Frequently asked questions
Where is SalesIro data hosted?
In a Supabase database located in the European Union, in Frankfurt. Data is encrypted in transit (TLS) and at rest. The application pages are served by Vercel, which stores no client data.
Can a sales rep see another rep's clients?
No, unless their management scope gives them access. Isolation is enforced by the database itself (row-level security), not by the screen: knowing the address of a page or a record is not enough.
Is my data used to train artificial intelligence?
No. SalesIro does not sell or transfer your data, and does not use it to train any model. The only function that sends text to an AI model is the formatting of dictated visit reports, when you use it; Anthropic, which runs it, does not use data sent through its API to train its models.
How can I tell whether data has left SalesIro?
Access through the API and AI assistants (Claude, ChatGPT, Perplexity) goes through keys that you create. Every call is recorded in a log the administrator can consult: which key, when, which data, how many rows. This log cannot be edited or deleted from the application.
What happens if an API key leaks?
You revoke it in Settings: it is refused immediately. SalesIro stores only the cryptographic hash of keys, never the key itself: a copy of the database would yield no usable key.
Can I retrieve or delete all my data?
Yes. Data can be exported from the application and through the API. At the end of the subscription, the workspace and its data are deleted on request. A data processing agreement (Article 28 GDPR) is provided on request.