Salesloft

GDPR overview

Salesloft's security and compliance page claims ongoing compliance with the GDPR and with the CCPA/CPRA, and the company holds ISO 27701 certification for privacy information management. A Data Processing Addendum is incorporated into the MSA and carries the Standard Contractual Clauses. Transfers rely first on the Data Privacy Framework, failing which on the EU SCCs (Modules 2 and 3) or the UK SCCs / IDTA A.1.0; the SCCs are governed by Irish law and Irish courts, with the Irish DPC as supervisory authority in Article 3(2) cases. Swiss transfers fall under the revised FADP, the FDPIC being competent. Data subjects in the EEA, the UK and Switzerland are offered access, rectification, erasure, restriction, portability, objection and complaint. The privacy contact is privacy@salesloft.com. One formal gap: no Article 27 EU representative is named in the documents collected, and the Platform Privacy Notice still dates from 22 March 2023.

Who owns the data?

The customer keeps its data. Clause 7.2 of the MSA makes the customer responsible for its Customer Data and has it warrant that it owns, or is sufficiently licensed to use, everything it uploads. Clause 3.1 leaves Salesloft and its licensors every right in the Services themselves, granting only a right of use. The Data Processing Addendum casts the customer as controller and Salesloft as processor. On termination, clause 5.3 allows Customer Data to be exported or downloaded on request within 90 days, after which Salesloft has no retention obligation. The Platform Privacy Notice adds that an authorized member of the organization can request deletion, though latency and residual backups are possible.

Reuse rights

Section 5 of the Platform Privacy Notice, effective 22 March 2023, states that data is used to deliver and maintain the services, for research and development, to understand usage and to resolve incidents. Statistical and de-identified information may be disclosed to other companies, provided no individual user is identified. Gmail data reached through Google OAuth carries stricter limits: reading, writing and modifying it serves only to compose, send, read and process email, never to serve advertisements, and no human reads it except with explicit consent, for security, under a legal obligation, or in aggregate form. Salesloft states that it adheres to the Google API Services User Data Policy, including its Limited Use requirements. Customers may reuse their own Customer Data freely, since they hold the rights to it, and may export or download it on request within 90 days of termination. What no collected document says, in either direction, is whether customer data feeds AI model training, and no exclusion option is documented.

Data retention & training

Hosting summary

The Salesloft platform is hosted in Amazon Web Services and Google Cloud data centers located in the United States and in the European Union; the Drift platform runs on AWS in the United States only. The security page describes a containerized microservices architecture replicated across geographically distinct data centers, with 24x365 physical security, environmental controls, redundant power and redundant telecommunications. Data is encrypted at rest with AES-256-GCM on top of the infrastructure provider's disk encryption, and in transit over HTTPS with TLS 1.2 or above; keys are managed and rotated automatically by the providers' key management services. Backups and business continuity and disaster recovery plans are reviewed periodically. International transfers are framed by the Data Privacy Framework, failing which by the EU or UK Standard Contractual Clauses. One technical detail should not be misread: salesloft.com resolves to 18.239.208.2, a CloudFront node (AS16509, Amazon) geolocated in Zaventem, Belgium. That is a content delivery point of presence serving the website, not a storage location; the data itself sits in the US and EU regions described above.