Legal / Suppliers
Service providers and subprocessors
The services used to deliver Signal OS and the roles they perform. A supplier is a subprocessor only to the extent it processes customer personal data on our behalf.
Last updated 16 September 2026 · Revision 2026-09-16.v1Hosting: Railway
Railway hosts the application and PostgreSQL database, with associated infrastructure and service operations. This can involve workspace data, account records and connection or operational logs. Railway is a processing provider for these hosting functions.
We do not represent the service as UK-only or EU-only. The selected production region and any supporting access or backup locations must be considered together; contact us for current deployment details before relying on a residency restriction.
Email: Resend
Resend acts as a processing provider for transactional and opted-in marketing email. Receiving functions, when enabled, route messages addressed to our service aliases into the support workflow. Processing can include addresses, message content and delivery status. Receiving integrations are designed to retain relevant threading and attachment metadata rather than automatically ingest every attachment.
Resend separately controls its own account, billing and usage records. Resend and its email infrastructure process information internationally, including in the United States. A selected email dispatch region does not necessarily change the location of account data. Account-specific retention and location details are available for review; this schedule does not promise a universal message or log-retention period.
Form protection: Cloudflare
Cloudflare Turnstile protects enabled public forms from automated abuse. It processes device, connection and challenge information, such as IP addresses and browser characteristics, through international infrastructure. Cloudflare acts as processor for protection of our site and also describes independent-controller processing to improve bot detection. This is separate from Signal OS’s consent-based website analytics.
Search and intelligence: Brave Search and OpenRouter
Brave Search supplies web-search results for configured research workflows. Queries can contain the business research context needed for the task. Customers should not include unnecessary personal or confidential information in a search instruction.
OpenRouter routes configured AI requests to downstream model providers for analysis, classification and draft generation. Task inputs and outputs may be processed by both the routing service and the selected endpoint. Provider identity and processing location can vary by the enabled route and must be reviewed for that route.
The restricted public-information categorisation route uses NVIDIA Nemotron and an allowlisted Dots Studio fallback for organisation or building classification. It excludes personal and customer-confidential content. This restriction does not describe every intelligence workflow, and no universal claim of zero retention or no training is made for all endpoints.
Customer-selected connections
Customers may connect CRM, mailbox, calendar and data services such as HubSpot, Google, Microsoft, Apollo or Lusha when supported and configured. A provider selected and separately contracted by the customer may act directly for that customer rather than as our subprocessor. The relevant connector permissions and contract determine information shared and each party’s role. Ask us to confirm the services active for your workflow.
Payment and banking providers
Paddle is Merchant of Record for purchases made through its checkout. It acts as an independent controller for its payment, tax, fraud-prevention and buyer-support purposes, rather than simply hosting workspace data as our processor. Its own privacy notice explains that relationship.
Revolut receives Signal OS’s business payouts and associated financial records. It is not an additional customer checkout integration and does not receive workspace research content merely because a customer pays through Paddle.
Locations, transfers and changes
A provider’s headquarters is not a complete statement of processing location. Some listed providers use international infrastructure and supporting providers, including in the United States. Contact privacy@signaloshq.com for information on the selected services and required transfer arrangements relevant to your contract.
Where our data processing addendum applies, new or replacement subprocessors follow its advance-notice and objection process. This schedule includes core and optional services; the services enabled for your workspace determine which providers apply. Ask us for the applicable provider, authorisation and transfer information when reviewing your agreement.