Subprocessors & Security
Last updated: August 24, 2026
SalesSprint is a small product built on a small number of well-known providers. This page lists every third party that processes customer data on our behalf and describes how we handle that data, so a team evaluating us doesn't have to ask. It sits alongside the Privacy Policy, which is the controlling document.
Current subprocessors
| Provider | Purpose | Data it receives | Region |
|---|---|---|---|
| Anthropic | AI prospect replies and call grading | Practice call transcript text and scenario details | United States |
| OpenAI | Text-to-speech for the AI prospect's voice | The text of the AI's lines to be spoken | United States |
| Groq | Speech-to-text on browsers without on-device recognition | A short audio clip of your spoken turn, discarded after transcription | United States |
| Sign in with Google (authentication) | Your name, email address, and profile picture | United States | |
| Stripe | Subscription checkout, billing portal, and payments | Billing contact details and payment method (handled by Stripe, not by us) | United States |
| Railway | Application hosting and the Postgres database | All application data stored by SalesSprint | United States |
How we handle your data
- No model training.We don't train AI models on your transcripts, and our AI providers process API content under terms that do not train on it either.
- No stored audio.Where your browser transcribes on-device, audio never leaves your machine. Where it can't, the clip goes to our transcription provider and is discarded after it returns text. We keep transcripts, not recordings.
- Encrypted in transit. The application is served over HTTPS, and we reach every provider above over encrypted connections.
- Session cookies are HttpOnly. Authentication and weekly-challenge cookies are not readable by page scripts, and the weekly-challenge transcript held for resume is encrypted.
- Access is limited. Only SalesSprint staff who need it can reach production data, and API credentials are held as environment secrets, never in the repository.
- US data residency. Application data lives in a managed Postgres database in the United States. We do not currently offer regional data residency.
- Deletion. Deleting your account removes your practice sessions and team memberships and cancels any active subscription. See the Privacy Policy for retention details.
What we don't claim
We want to be straight with buyers rather than impressive. SalesSprint does not currently hold a SOC 2, ISO 27001, or HIPAA attestation, and we haven't completed a third-party penetration test. Practice calls are roleplays with an AI, so the product is not designed to hold recordings of real customer calls, regulated health data, or payment card data. Please don't put that kind of content into a practice session.
Changes to this list
If we add or replace a subprocessor, we'll update this page and change the date at the top. Teams on a paid plan can email us to be notified of changes in advance.
Data processing agreements and security questions
If your company needs a data processing agreement (DPA) or has a security review to run before rolling SalesSprint out to a team, email hello@salessprint.ai and we'll work through it with you.
Reporting a vulnerability
If you find a security issue, please report it to hello@salessprint.ai rather than disclosing it publicly, and give us a reasonable window to fix it. We won't pursue legal action over good-faith research that respects user privacy and avoids degrading the service.