Sub-processors and Connected Data Sources
Last updated 21 October 2026This is Relae's Sub-processor and Data Source page. The Data Processing Agreement incorporates it by reference as the authoritative, current list of Relae's Sub-processors and available Connected Data Sources. In the DPA's own words (clause 5):
“The Customer authorizes Relae to engage the Sub-processors listed on Relae's Sub-processor and Data Source page, maintained at relae.ai/subprocessors and incorporated into this DPA by reference. That page is the authoritative, current list; Relae keeps it accurate as Sub-processors and available Connected Data Sources change, and the snapshot in Schedule 2 below is provided for convenience as of this DPA's date and does not override the page.”
Website and account data providers are identified separately below: Relae controls those inquiries and account records. A website inquiry does not mean donor records are sent to every provider in this list. The Privacy Policy describes the different data flows.
| Function | Provider | Region | Data and purpose |
|---|---|---|---|
Website inquiry and system email delivery Website and account data provider | Resend (Plus Five Five, Inc.) | United States; delivery also involves recipient email systems | Delivers inquiry acknowledgments and internal inquiry notifications, account invitations and system messages. Processes recipient email addresses and message contents. Relae acts as controller for website inquiries; this provider is distinct from the AWS SES signing-service mail rail. This entry does not enable donor fundraising email or promise Canadian-only email processing. |
Cloud database, auth, storage Sub-processor | Supabase | ca-central-1 (Canada) | Primary data store, authentication, file storage for the Canadian Region. |
Application hosting Sub-processor | Vercel | Compute pinned to Montreal (yul1); global edge for content delivery | Application hosting. Request compute for the Canadian Region runs in Canada; no Donor Data is stored at the edge. |
AI, document signing and transactional email infrastructure Sub-processor | Amazon Web Services (Bedrock for AI; ECS Fargate, EFS and RDS for the self-hosted signing service; SES for transactional email) | Canada (ca-central-1); United States for Capture and Ask Relae requests unless the organization chooses Canada-only Processing | AI: coaching, thank-you drafting and report descriptions run in Canada. With Canada-only Processing, import planning and mapping hints also run in Canada. Capture and Ask Relae run in Canada or, as Pseudonymized Requests, in the United States (Document 7 clause 2). AWS states that Bedrock content is not used to train models and is not shared with model providers; whether AWS retains a request depends on the model and the data-retention setting in each Region (Document 7 clause 4). Signing infrastructure: Relae's self-hosted DocuSeal runs on AWS compute and storage in Canada and holds executed agreements, being a signer's name, email, signature image and completion certificate. Transactional email: outbound mail from the signing service, being signature requests, reminders and completion notices, is relayed through Amazon SES in Canada, which processes the recipient's name and email address and the message contents in transit. No Donor Data passes through the signing service or its mail relay. For the Canadian Region, recordings and attached audio are sent to Amazon Transcribe in ca-central-1, with private input and output storage on Amazon S3 in the same region. Audio is sent as recorded, including any names or other personal information spoken; the text identifier replacement in clause 3 is not applied to audio. Amazon Transcribe is a separate service from Bedrock. AWS states that Transcribe stores and uses voice inputs for service improvement by default and permits an AWS Organizations opt-out. Relae enables its Transcribe route only when it has verified the effective opt-out for the account processing the audio. After the transcript is saved in Relae, Relae attempts to delete the temporary audio, the provider's transcript file and transcription job. Cleanup can be delayed or fail; the private S3 objects also have an expiry rule set to seven days, and AWS lifecycle deletion may occur after the expiry time. This is not a promise of immediate deletion. |
AI import planning, appeal planning and research Sub-processor | Anthropic API and web-search services | United States | Import planning (unless Canada-only Processing is chosen): a profile of an imported file (file and sheet names, column headers and types, counts, and up to three sample values from each column that does not look identifying) and any instruction the person importing types; never the imported rows. Mapping hints under the same processing choice send column headers, the current mapping and the person's instruction about that mapping. With Canada-only Processing both use the Canadian model instead. Appeal planning (unless Canada-only Processing is chosen, and only when a person uses it on an appeal): the appeal's structure, with each household as a Relae reference code with its giving and ask amounts and gift dates, never its name or contact details, and the text the person types, after Directory replacement and checks for postal addresses, government and financial identifiers and length; with Canada-only Processing it does not run. Funder research (entitlement-gated, off by default): names of funding organizations and the organization's areas of interest. Donor research (opt-in): the prospect's name and public identifying context, never the private record. Import planning, mapping hints, funder research and donor research are Named Exceptions: no Directory replacement is applied to them. Anthropic's terms state that it may not train models on customer content, and Anthropic states that it deletes API inputs and outputs within 30 days, longer for content it flags (Document 7 clause 4). |
Connected event data source (optional, at the Customer's direction) Connected Data Source | Eventbrite | United States | Where a Customer connects its Eventbrite account, the Platform reads event and attendance data, which can include donor personal information, into the Customer's workspace. Read-only; nothing is written back. |
Connected email marketing data source (optional, at the Customer's direction) Connected Data Source | Mailchimp | United States | Where a Customer connects its Mailchimp account, the Platform reads account identity, draft and sent campaigns, email designs and content, sender details, recipient delivery status, and email activity, which can include donor personal information, into the Customer's workspace. At the Customer's explicit direction, prepared email addresses, sender details and message content are sent to Mailchimp to create a dedicated audience tag and draft campaign for review. Relae does not send email or change subscription consent. |
Public registry lookups Public registry | CRA / open.canada.ca | Canada (government) | Charity-registry and public-filing lookups. Relae sends only a charity business number; no donor personal information. |
How changes are notified
During our Beta phase, this page is Relae's mechanism for notifying you of Sub-processor changes. Relae keeps this register current as services are added or replaced. Once Relae reaches general availability, you will receive at least thirty (30) days' advance notice by email and in-app notification before adding or replacing a Sub-processor.
You can object to a new Sub-processor on reasonable data-protection grounds. If an objection cannot be resolved, you may terminate the affected Services and receive a pro-rata refund of unused fees. Relae imposes data-protection obligations on each Sub-processor materially equivalent to the DPA and remains responsible for their performance.
Connected Data Sources are engaged at your direction: each one operates only for a customer that chooses to connect it, and the connection surface in the product describes the data involved, the direction of the flow, and the source's region before you connect.