Alongrail Desk
Sub-processors
Every third party that receives your data or your customers’ data for Alongrail Desk, what each one receives, and where it operates. When the list changes, the date below changes with it.
List last changed 13 October 2026
- AnthropicReading screens and documents
- Screen frames during a guided session, and, when your team writes a help article, the screens before and after each step it captures. Whole PDF files when you upload them. The text of your documents when workflows are drafted, and of your help articles when Desk writes or changes them. Your company’s name and the published workflow. What customers type, and the session so far. It deletes what it receives within 30 days under its standard policy, or keeps it longer only where the law requires or where it is flagged for misuse.Processing may happen in any region; storage in the United States
- VercelApplication hosting
- All traffic to the service, and everything in it as it passes through: pages, requests, screen frames, uploads and your material. Network addresses. Request logs, kept for 30 days. If you show a help article on your website, copies of its page and pictures in its global network’s cache: the page refreshed within a minute of any change, the pictures for 10 minutes.Runs our functions in Singapore; serves pages from its global network; may process data in the United States and elsewhere
- NeonDatabase
- Everything Desk stores: your company record and details, your team’s names and email addresses, your material as text, your workflows, invites, session records including what customers typed and the text read off their screens, and payment records. For article writing, it also holds your help articles’ text and the screenshots your team keeps in them; your team can cover anything private before saving each one.Singapore
- ResendTransactional email
- The addresses we write to (a sign-in link for each member of your team, and your contact address) and the text of each message. The monthly report quotes questions your customers typed and what their screens showed.United States
- Dodo PaymentsPayments, as merchant of record
- The name and email address of the member who pays, your desk’s id and the pack; your card and billing details go to Dodo directly. It is the legal seller; we never receive a card number.United States and India
- GoogleSign-in, only where used
- Only when a team member signs in with Google: it confirms their email address to us, and also returns their name and profile picture, which we discard.United States
- PostHogProduct analytics on our own pages
- Page views on the Alongrail site, including your dashboard: each page’s address, which contains your desk’s link name (and a session’s id when one is opened), the referring page, the device and browser, and a location worked out from the network address. Not loaded on a customer’s session page or on a help article shown on your website. When someone arrives from a “Guided by Alongrail” or “Made with Alongrail” link, one more event notes which desk’s link it was, as a short code, and nothing more about them.United States
Also used, and not on the list because they process nothing on your behalf:
- GitHub runs our automated checks that the site answers, and holds no company or customer data.
- Hostinger hosts our own mailbox, which holds the letters we wrote to companies before they signed up, and their replies.
Our application and our database run in Singapore; the list says where each of the others operates. If you need the EU standard contractual clauses (processor module), please write to us and we’ll send them; for another transfer mechanism, please write to us before you buy and we’ll tell you plainly whether we can meet it. Questions about this list go to hello@alongrail.com, and a person reads every message.