Last updated: 15 October 2026
Helm uses the third parties below to provide the service. Each one processes customer personal data only on our instructions, under a written data processing agreement that passes on obligations equivalent to those in our Data Processing Agreement. We keep customer data in the United Kingdom or the European Economic Area, except where stated below, and each exception is covered by an Article 46 UK GDPR safeguard. We give customers at least 30 days’ notice before adding or replacing a sub-processor.
Download this page as a PDF (version of 15 October 2026)
Infrastructure and platform
Sub-processor | Location and safeguard |
|---|---|
Neon, Inc. Personal data: all stored data; mailbox content, recipient identities, comment bodies and voice snapshots encrypted at rest; routing metadata in clear | United Kingdom (London) Safeguard: DPA with EU SCCs + UK Addendum |
Fly.io, Inc. Personal data: processes data in memory to run the service; no persistent content storage | United Kingdom (London) Safeguard: DPA with Article 46 transfer safeguards |
Cloudflare, Inc. Personal data: proxies inbound web traffic; does not store mailbox content | Global edge; EU/UK localisation available Safeguard: DPA with EU SCCs + UK Addendum |
Okta, Inc. (Auth0) Personal data: sign-in identity, multi-factor assertions, mailbox authorisation tokens | United Kingdom Safeguard: DPA with EU SCCs + UK Addendum |
AI model processing
Sub-processor | Location and safeguard |
|---|---|
OpenRouter, Inc. Personal data: decrypted message content needed to prepare a draft or triage a message | EU in-region; zero data retention, no data collection, no fallback outside the EU Safeguard: DPA with EU SCCs + UK Addendum |
The AI model used for each task is configuration and may change. A model change that changes the provider counts as a sub-processor change and gets 30 days’ notice.
Communications, logging and analytics
Sub-processor | Location and safeguard |
|---|---|
Plus Five Five, Inc. (Resend) Personal data: staff email address, a short notice, inbound colleague reply; no mailbox content | United States Safeguard: DPA with EU SCCs + UK Addendum + UK Extension to the Data Privacy Framework |
Raintank Inc. (Grafana Labs) Personal data: identifiers, status codes and counts only; no message body, address or token | United Kingdom (London) Safeguard: DPA with EU SCCs + UK IDTA |
Functional Software, Inc. (Sentry) Personal data: scrubbed error events; no request bodies, cookies, query strings, user identifiers or message content | European Union (Frankfurt) Safeguard: DPA with EU SCCs + UK Addendum |
Resend uses Svix Inc. to deliver webhooks.
Your connected providers |
|---|
Helm connects to the mailbox, calendar and contacts in your own Google Workspace or Microsoft 365 account. That data stays in your tenancy under your own agreement with Google or Microsoft. |
Planned changes
New or replacement sub-processors are listed here at least 30 days before they start processing customer personal data.
Sub-processor | Location and safeguard |
|---|---|
PostHog, Inc. Personal data: a fixed set of behavioural events; no PII and no message content | European Union (Frankfurt) Safeguard: DPA with EU SCCs + UK Addendum Notice given: 15 October 2026 Takes effect: 14 November 2026 or later |
Get notified of changes
To hear about changes to this list, email hello@usehelm.co.uk and ask to be added.
Change log
Date | What changed | Why |
|---|---|---|
Page published, with the sub-processors and transfer safeguards previously set out in Annexes B and D of our Data Processing Agreement | So customers can check the current list at any time | |
PostHog, Inc. added to Planned changes | Product analytics, from 14 November 2026 at the earliest |
