Mitra CRM Subprocessors
Version 1.4.0
This page lists the service providers ("subprocessors") that Automaid uses to run Mitra CRM, and what each one does. It covers Mitra CRM only. It is referenced by section 4 of the Mitra CRM Privacy Policy.
For each provider, "type of processing" describes what it does with information: storage (it holds information in its own systems), compute (it runs code that acts on the information), and transit (information passes through it). A provider can do more than one. Where a provider also retains what passes through it, that is recorded as storage.
Providers
Supabase
What it does for Mitra CRM. The application database and staff authentication. Holds all workspace records — leads, jobs, quotes, messages, staff accounts and the audit trail — and runs the queries against them.
Type of processing. Storage and compute.
Vercel
What it does for Mitra CRM. Application hosting. Runs the Mitra CRM application and carries everything the app renders or accepts. Vercel also collects page-view and performance measurements from visitors' browsers (Vercel Analytics and Speed Insights) and stores them.
Type of processing. Compute, transit and storage (analytics).
Resend
What it does for Mitra CRM. Delivers transactional email sent by the product, such as staff invitations. Resend retains the message content it sends and its delivery logs in its own systems.
Type of processing. Transit and storage.
Google (Maps Platform — Places)
What it does for Mitra CRM. Address autocomplete when your staff enter a service address. The address text is sent from your staff member's browser to Google as they type, and Google runs the search against it. Google's documentation states that Maps Platform requests are logged, including the request URL and its parameters, the requesting IP address and the date and time. Google does not publish a fixed retention period for those logs.
Type of processing. Transit, compute and storage (logs).
Cloudflare (Turnstile)
What it does for Mitra CRM. Bot protection on the sign-in, sign-up and password-recovery pages. Cloudflare's challenge widget loads in the visitor's browser, and the token it issues is checked by our server against Cloudflare before the request proceeds. To run that check, Cloudflare receives the connection and browser signals of the person on the page.
Type of processing. Transit and compute.
Sentry
What it does for Mitra CRM. Error and performance monitoring. Receives diagnostic events from the application. We configure Sentry not to send default personal data, and we filter events before they are sent — email addresses and phone numbers are redacted from message text, and URLs and query strings are stripped. That filtering targets known fields and patterns; it is not a guarantee that no personal information ever reaches Sentry.
Type of processing. Storage.
Help Scout
What it does for Mitra CRM. Our support help desk. When someone in your workspace contacts support from inside Mitra CRM and agrees to send the request, Help Scout receives their email address, the subject and message of the request, the page of Mitra CRM they were on, identifiers for their workspace and user account, and reference identifiers for the Assistant answer and help articles involved. A request sent from the in-app Assistant also carries the recent conversation with the Assistant, with money amounts and percentages removed where Mitra CRM can recognise them. Help Scout holds each request and our replies, and our support staff answer from it.
Type of processing. Transit and storage.
Google Workspace
What it does for Mitra CRM. Automaid's own mailbox for privacy questions and contractual notices. Holds the messages you send us.
Type of processing. Storage.
Anthropic
What it does for Mitra CRM. Engineering support tooling (Claude Code) that Automaid uses to build and maintain Mitra CRM. Under owner-controlled conditions it can query the production database, so workspace data may be sent to Anthropic, processed by it and retained by it during that maintenance work.
Type of processing. Transit, compute and storage.
OpenAI
What it does for Mitra CRM. Two things.
The in-app Assistant. When someone in your workspace asks the Assistant a question, Mitra CRM may send it to OpenAI's API so that OpenAI can word the answer from Mitra CRM's help articles. The request carries the question exactly as it was typed, the previous question when the new one follows on from it, and the help-article text Mitra CRM chose to answer it. For a question about one of your workspace's settings, it also carries what Mitra CRM read for that setting and shows beside the answer, such as the tax rate, the timezone, or your business name and address.
The Assistant also answers questions from its help articles in a newer way, now switched on in every workspace. For those questions, OpenAI receives the question; up to four earlier questions from the same conversation, each with the title of the help article or report its answer drew on; the text of about 24 Mitra CRM help articles, from which it chooses and writes the answer; and the names and descriptions of the Mitra CRM reports the person asking may run. Values Mitra CRM reads from your workspace are not sent on this path; Mitra CRM adds them to the answer itself.
For a question about your workspace's own records, OpenAI receives the question, and the previous question with the name and filters of the report it led to, so that it can suggest which of Mitra CRM's reports to run. The report itself runs inside Mitra CRM, and its results are not sent to OpenAI.
Beyond these, Mitra CRM adds no name, email address or account identifier to these requests, but anything typed into a question is sent as it was typed. Mitra CRM's requests ask OpenAI not to store them for later retrieval. Requests made before version 1.1.0 of this page did not include that instruction, so OpenAI's default storage applied to them; OpenAI's documentation describes that default as 30 days. OpenAI may also keep requests for a limited time under its own terms, for example to monitor for abuse.
Engineering support tooling. Codex, which Automaid uses to build and maintain Mitra CRM. Under owner-controlled conditions it can query the production database, so workspace data may be sent to OpenAI, processed by it and retained by it during that maintenance work.
Type of processing. Transit, compute and storage.
TypeSafe AI
What it does for Mitra CRM. An optional feature that suggests how to sort an email from a sender we don't recognise: a new enquiry, an existing customer, or junk. For workspaces where it is switched on, we send the email's subject, the sender's name and domain, and up to 2,000 characters of message text from each of up to three human-written messages, with email addresses, phone numbers and money amounts removed. The message text can still include anything the sender wrote, such as names, street addresses or payment details in words. We do not send any of your customer records, attachments or workspace, user, conversation or message identifiers. TypeSafe processes this data under its data processing addendum (24 April 2026), keeps it as long as it needs to under that addendum, and states that it does not use it to train its models. Zero data retention is enterprise-only and is not enabled. We have not confirmed a SOC 2 report or a processing region. Your team confirms every suggestion; nothing is created, linked or deleted automatically.
Type of processing. Transit, compute and storage.
Not used by Mitra CRM
We are sometimes asked about these. As of this version they are not integrated and receive no information from Mitra CRM: payment processing and SMS/text messaging.
Where information is processed
Our core systems run in the United States: the application database and authentication (Supabase), and the application hosting that runs Mitra CRM (Vercel). Email delivery storage (Resend) is also in the United States.
Some providers process information outside Canada and the United States. Google's Maps Platform may process address autocomplete requests internationally.
We name a provider's region here only once we have confirmed it.
Changes
We update this page when a provider is added, removed or changes role. The Privacy Policy links here rather than repeating the list, so this page is the current source.
Version 1.3.0 describes what OpenAI receives when the in-app Assistant answers in the newer way it is trying in workspaces we choose.