GambitSubprocessors
The services that process data for Gambit, Gambit Mail Sync, the Gmail add-on, the Outlook add-in, which works only with Gambit Beta, and the website at gambit.humanr.ai. Your CRM data stays in your Jira site and the Forge storage Atlassian hosts for it; the services below receive only what each row says.
| Subprocessor | What it does | What it receives | Where | When |
|---|---|---|---|---|
| Atlassian | Hosts Gambit and Gambit Mail Sync: Jira, Forge storage, Forge LLM and app logs | Everything the apps hold | Your Jira site's data residency region; Forge LLM in Atlassian's published regions | Always |
| Gmail and Google Calendar capture, and the Gmail add-on, which runs on Google Apps Script | Mail and calendar data of the mailboxes your organisation connects, and the email open in the add-on | Your organisation's Google Workspace | When your organisation connects Google Workspace | |
| Microsoft | Microsoft 365 mail and calendar capture, and the Outlook add-in | Mail and calendar data of the mailboxes your organisation connects, and the email open in the add-in | Your organisation's Microsoft 365 tenant | (Beta only) When a design partner connects Microsoft 365 to Gambit Mail Sync Beta |
| Cloudflare | Static website hosting, sign-in redirect pages, cookieless website analytics, the website's forms and the marketing site's mailing list | Website visits, sign-in codes in transit, what you type in a website form, and the email addresses (with a hashed IP address and user agent) given on the mailing-list form; stores no CRM data | Cloudflare's global network | Always |
| PostHog | Product usage analytics | Screens, features, timings and setup steps, keyed by pseudonymous site and user IDs; never names, email addresses, record content or prompts | United States (PostHog's US cloud) | On by default; admins can switch it off in Atlassian's admin controls |
| Sentry | Error reports | Error type and stack trace, keyed by a scrambled site ID, with the import run ID and scrambled row references; never a person, name, email address, record content or prompts | United States (Sentry's US region; the apps refuse any other) | On by default; admins can switch it off in Atlassian's admin controls |
| Loops | Product and onboarding email | Name, email address and company of licence and evaluation contacts and of people who sign up for release updates or the launch list on the website, with the launch video and platform that sent them and the time they agreed to email | United States (Loops' servers) | Until the person unsubscribes, with one click |
| logo.dev | Company logos for new and enriched accounts | A company's web domain only | Mainly the United States (logo.dev's servers) | When Gambit Mail Sync adds a company's logo |
| Salesforce | Import from Salesforce | The import your admin starts, on your organisation's own Salesforce account | Your organisation's Salesforce account | From January 2027, only when your admin turns it on (not in this version) |
| HubSpot | Import from HubSpot | The import your admin starts, on your organisation's own HubSpot account | Your organisation's HubSpot account | From January 2027, only when your admin turns it on (not in this version) |
| Pipedrive | Import from Pipedrive | The import your admin starts, on your organisation's own Pipedrive account | Your organisation's Pipedrive account | From January 2027, only when your admin turns it on (not in this version) |
| Apollo | Contact and company enrichment | A contact's email address or a company's web domain, on your organisation's own Apollo key | United States | From January 2027, only when your admin turns it on (not in this version) |
| People Data Labs | Contact and company enrichment | A contact's email address or a company's web domain, on your organisation's own People Data Labs key | United States | From January 2027, only when your admin turns it on (not in this version) |
| European Central Bank | Daily exchange rates for deal values in other currencies | A request for the day's rates; nothing about your organisation | European Union | From January 2027, only when your admin turns it on (not in this version) |
| SAM.gov | US federal contract opportunities for government contractors | The search filters your admin sets, on your organisation's own SAM.gov key | United States | From January 2027, only when your admin turns it on (not in this version) |
| Slack | Gambit alerts in a Slack channel | The alert text your admin chooses to send, to your organisation's own Slack incoming webhook | Your organisation's Slack workspace | In a later release, only when your admin connects your organisation's own Slack webhook; nothing is sent until then (not in this version) |
| Microsoft Teams | Gambit alerts in a Microsoft Teams channel | The alert text your admin chooses to send, to your organisation's own Teams workflow | Your organisation's Microsoft 365 tenant | In a later release, only when your admin connects your organisation's own Teams workflow; nothing is sent until then (not in this version) |
| Zapier | Gambit events in your Zapier automations | The events and fields your admin chooses to send, to your organisation's own Zapier webhook | United States (Zapier's servers) | In a later release, only when your admin connects your organisation's own Zapier webhook; nothing is sent until then (not in this version) |
| Make | Gambit events in your Make scenarios | The events and fields your admin chooses to send, to your organisation's own Make webhook | Your Make organisation's region (EU or US) | In a later release, only when your admin connects your organisation's own Make webhook; nothing is sent until then (not in this version) |
| Brave Search | Web search for account and contact research | The search terms, such as a company name or web domain, on your organisation's own Brave Search API key | United States | In a later release, only when your admin connects your organisation's own Brave Search API key; nothing is sent until then (not in this version) |
| Anthropic | AI features on your own Anthropic key, instead of Atlassian-hosted models | The prompt and the records it needs, on your organisation's own Anthropic key | United States | In a later release, only when your admin connects your organisation's own Anthropic key; nothing is sent until then (not in this version) |
| OpenAI | AI features on your own OpenAI key, instead of Atlassian-hosted models | The prompt and the records it needs, on your organisation's own OpenAI key | United States, or the region your OpenAI project uses | In a later release, only when your admin connects your organisation's own OpenAI key; nothing is sent until then (not in this version) |
| Microsoft Azure AI | AI features on your own Azure OpenAI or Azure AI Foundry resource (including Claude and other Foundry models), instead of Atlassian-hosted models | The prompt and the records it needs, on your organisation's own Azure resource and key | The Azure region your organisation chose for its resource | In a later release, only when your admin connects your organisation's own Azure key; nothing is sent until then (not in this version) |
Logos by Logo.dev.
Usage analytics and error reports are on when the apps are installed; admins switch them off in Atlassian's admin controls for apps, and the apps keep working without them. The import, enrichment, exchange-rate and contract-opportunity services receive nothing until your admin turns each one on.
We announce a new subprocessor at least 30 days before it receives data, on this page and by email to your licence's technical contact. Questions: privacy@gambit.humanr.ai.