Last updated 12 October 2026
Salesmotion is an account intelligence platform. It monitors publicly available company information (news, filings, earnings calls, job postings, funding events) and turns it into signals, research briefs, and outreach drafts for B2B sales teams. This page explains what data the platform processes, what it does not, and how it is protected, in the order security reviewers usually ask.
The intelligence layer of Salesmotion is built on publicly available company information: press and news coverage, regulatory and financial filings, earnings call transcripts, company websites, job postings, podcasts, and funding disclosures. The subject of the data is the company you sell to, not private records about individuals.
This matters for risk assessments: Salesmotion does not process patient data, clinical records, health information, payment card data, or any special-category personal data. For life sciences and other regulated industries, the distinction between tracking target accounts on public data and processing sensitive records typically places Salesmotion in a materially lower risk tier during vendor review.
To run your workspace, Salesmotion stores:
Salesmotion runs on established cloud infrastructure providers in certified data centers. Data is encrypted in transit (TLS) and at rest. Access to production systems is restricted to authorized personnel, authenticated and logged. Backups run automatically, and infrastructure providers maintain their own industry certifications for the physical and platform layers.
Salesmotion Limited offers a standard Data Processing Agreement covering GDPR, UK GDPR, and applicable U.S. state privacy laws, including subprocessor terms and international transfer mechanisms. Our Privacy Policy describes processing in full. Data subject requests and deletion requests are honored per the DPA: when a customer leaves, workspace data is deleted on request.
Salesmotion does not currently hold an ISO 27001 or SOC 2 certification. We are transparent about this because security reviewers ask, and because the platform's narrow data surface (public company information plus workspace configuration) keeps the practical risk profile small. For enterprise evaluations we support security questionnaires, DPIA processes, and vendor reviews with documentation, and we answer them quickly. Several enterprise and life sciences customers have completed vendor review with these materials.
If you believe you have found a security vulnerability, email support@salesmotion.io with the details. We acknowledge reports quickly and prioritize verified issues.
The questions procurement, legal, and vendor-risk teams send during review, each answered from our published documents: this page, the Data Processing Agreement, the Privacy Policy, the Terms of Service, and the help center.
Salesmotion is an account intelligence platform. Its intelligence layer is built on publicly available company information: press and news coverage, regulatory and financial filings, earnings call transcripts, company websites, job postings, podcasts, and funding disclosures. The subject of the data is the company you sell to, not private records about individuals.
Five categories. Workspace data: your tracked account list, keyword configuration, and workspace settings. User data: names, work email addresses, and authentication credentials for your team's users. Business contact data: professional contact information for decision-makers at the companies you track (names, titles, business emails and phone numbers). CRM data you connect: if you enable the Salesforce or HubSpot integration, the fields you configure to sync. Usage data: product analytics that help us improve the platform. The DPA's details of processing add job titles and IP addresses to the personal data types, and state that special category data is not intentionally collected.
Source: Data Processing Agreement
No. Salesmotion processes publicly available company information and business contact data. It does not touch patient records, trial subject data, health information, or any special-category data, which is why life sciences vendor reviews typically place it in a low-risk category.
Salesmotion Limited, a company registered in England and Wales with its principal office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. The Terms of Service are governed by English law, with the English courts as the exclusive jurisdiction.
Source: Terms of Service
All three are public: the Terms of Service, the Data Processing Agreement, and the Privacy Policy. Each is effective as of 31 January 2025. The DPA is incorporated into the Terms of Service by reference where you provide personal data for processing on your behalf. If you sign an Order Form, the Order Form prevails where it conflicts with the Terms. The Privacy Policy covers personal information Salesmotion controls itself, such as website visitors and direct business contacts.
Source: Terms of Service, Data Processing Agreement, Privacy Policy
Yes. Salesmotion Limited processes personal data in line with GDPR and UK GDPR, offers a standard DPA with subprocessor and international transfer terms, and honors data subject and deletion requests.
Source: Data Processing Agreement
Salesmotion processes Customer Personal Data only on your documented instructions and for the purpose of providing the Services. It does not sell or share Customer Personal Data. It keeps records of processing as Article 30 of the GDPR requires, gives reasonable assistance with data subject requests and data protection impact assessments, and binds personnel and subprocessors to confidentiality. Where data protection laws grant an audit right, you may audit compliance with the DPA once per year with at least thirty days' written notice.
Source: Data Processing Agreement
Salesmotion is headquartered in the United Kingdom. Where Customer Personal Data moves from the EEA, Switzerland, or the UK to a jurisdiction without an adequacy decision, the DPA relies on the EU 2021 Standard Contractual Clauses (Module 2 for controller to processor and, where applicable, Module 3 for processor to processor), together with the UK Addendum and Swiss-specific modifications. Signing the Agreement constitutes signature to the SCCs where they apply.
Source: Data Processing Agreement, Privacy Policy
Attachment 2 of the DPA lists them with purpose and location: Amazon Web Services (cloud hosting and infrastructure, EU, Germany), Google Cloud (cloud infrastructure and data storage, EU, Germany), HubSpot (CRM and marketing platform, EU), Supabase (database hosting and backend services, EU), Amplitude (analytics platform, EU), Avoma (meeting intelligence services, US), Hotjar (user behavior analytics, US), and OpenAI (language model services, US). Subprocessors are bound by written agreements with data protection terms no less protective than the DPA, and Salesmotion remains liable for their acts or omissions regarding Customer Personal Data. Where data protection laws require it, Salesmotion informs you before appointing a new subprocessor, and you may object on legitimate data protection grounds within ten days of notice.
| Subprocessor | Purpose | Location |
|---|---|---|
| Amazon Web Services | Cloud Hosting/Infrastructure | EU (DE) |
| Google Cloud | Cloud Infrastructure/Data Storage | EU (DE) |
| HubSpot | CRM / Marketing Platform | EU |
| Supabase | Database Hosting/Backend Services | EU |
| Amplitude | Analytics Platform | EU |
| Avoma | Meeting Intelligence Services | US |
| Hotjar | User Behavior Analytics | US |
| OpenAI | Language Model Services | US |
Source: Data Processing Agreement
Not currently. We state this plainly rather than obscuring it. The platform's data surface is public company information plus your workspace configuration, and we support enterprise security reviews with questionnaires and documentation. If a certification is a hard requirement for your procurement process, talk to us about timeline.
Salesmotion runs on established cloud infrastructure providers in certified data centers. Data is encrypted in transit (TLS) and at rest. Access to production systems is restricted to authorized personnel, authenticated and logged. Backups run automatically, and infrastructure providers maintain their own industry certifications for the physical and platform layers. Under the DPA, Salesmotion maintains technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, disclosure, or access.
Source: Data Processing Agreement
Workspace admins control who joins the workspace, and users are added by invitation only. Each user has individual credentials, and account ownership scopes alerts and visibility. Admins add and remove users from the Users tab in Settings. Single sign-on is available for enterprise plans, contact us for details.
Source: Managing users and seats
API access uses scoped keys that can be rotated. Each request carries the key as a bearer token in the Authorization header. The MCP server that connects Salesmotion to Claude does not store data: every request passes through to the Salesmotion API with your credentials. A team can connect with one shared Service key that an admin creates and can revoke, and deleting that key ends access for everyone connected with it.
Source: API reference, Claude connector for IT and security teams
Only the fields you configure are synced. The scope is under your control, and the integration can be disconnected at any time. The HubSpot sync is one-way, from Salesmotion to HubSpot, and writes only its own Salesmotion fields. The Salesmotion API key and the HubSpot access tokens are stored encrypted, and disconnecting deletes them.
Source: HubSpot integration
Your data is never shared or used for external AI training. Signals and research remain private to your organization, with encryption in transit and at rest. Under the DPA, Salesmotion may process aggregated, de-identified, or anonymized data to maintain and improve the Services, to detect or prevent security incidents, and to protect against fraudulent or illegal activity, and that processing is not identifiable to any data subject.
Source: Data Processing Agreement
Under the DPA, Salesmotion notifies you without undue delay and no later than seventy-two hours after becoming aware of a Security Incident. Where possible, the notification includes the nature of the breach and the steps taken to mitigate potential harm. Salesmotion promptly takes steps to contain, investigate, and remediate the incident, and reasonably assists you with your own breach reporting obligations.
Source: Data Processing Agreement
On termination or expiration of the Agreement, or earlier on written request, Salesmotion securely deletes or returns all Customer Personal Data. Returned data comes in a commonly used, machine-readable format unless otherwise agreed. Salesmotion may retain minimal data strictly necessary for legal obligations or legitimate business needs such as billing or dispute resolution. On request, Salesmotion provides written certification that the data has been deleted or returned.
Source: Data Processing Agreement
Scanning or testing the vulnerability of the Services needs Salesmotion's prior written consent under the Terms of Service, so agree the scope with us first. If you believe you have found a security vulnerability, email support@salesmotion.io with the details.
Source: Terms of Service
Email support@salesmotion.io or raise it with your point of contact. Standard questionnaires (including DDQ and CAIQ-style formats) are typically returned within a few business days.
For enterprise evaluations we support security questionnaires, DPIA processes, and vendor reviews with documentation. Under the DPA, Salesmotion provides additional documentation or information about its security measures on written request, subject to reasonable confidentiality obligations. Security and legal review is part of enterprise plans.
Source: Data Processing Agreement, Pricing
Security questionnaires, vendor reviews, and vulnerability reports: support@salesmotion.io. Data protection: Salesmotion's Data Protection Officer is its CEO, Semir Jahic, at semir@salesmotion.io. Requests to exercise privacy rights: hi@salesmotion.io. Contractual notices: Salesmotion Limited, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom, with a copy to sales@salesmotion.io.
