The short version
These are the only outside companies that process customer data for us. Each is under contract to use it only to provide its service to us.
This summary is for convenience. The full text below is what applies.
1. Current subprocessors
| Company | What it does for us | Data involved | Location |
|---|---|---|---|
| Amazon Web Services, Inc. | Application hosting, database, file storage and backups | All customer data, encrypted at rest | United States |
| Cloudflare, Inc. | Domain name service, content delivery, protection against attacks, and the secure connection between the internet and our servers. Helping two devices find each other when a live session starts (the video and sound then go between the devices) | Web traffic passing to and from the service, IP addresses | Global network; traffic is handled at the location nearest the user |
| ActiveCampaign, LLC (Postmark) | Sending service emails: verification, password reset, invitations, notices, daily-log digests. Receiving email that people send or copy to a project’s own address, so it can be filed on that project | Recipient name and email address, and the content of the email; for mail sent to a project’s address, the sender, recipients, text and attachments of that message | United States |
| Stripe, Inc. | Subscription billing and payment processing | Billing contact, plan, and payment details you enter on Stripe’s pages. Stripe also acts as an independent controller of payment data. | United States |
| OpenAI, L.L.C. | AI models behind the assistant, voice transcription and spoken replies | Only what is sent to the assistant: your messages, attached photos, voice audio, and the records the assistant looks up to answer. Not used for training; retained up to 30 days for abuse monitoring. | United States |
| U.S. National Weather Service (NOAA) and the U.S. Census Bureau geocoder | Weather for the daily log. These are public services of the United States government, not vendors under contract to us; we list them because a little project data reaches them | The project’s street address (to find it on the map, once per project) and map coordinates rounded to about 100 m with the date. No names, no account details, nothing about your people. Not used if you type the weather in | United States |
OpenAI processes data only for companies that use the assistant. Administrators can switch the assistant off in Settings.
2. Changes to this list
We update this page at least 30 days before a new subprocessor begins processing customer data. To be notified by email, write to privacy@pmt1.com with the subject “Subprocessor updates”. Customers may object to a new subprocessor as described in our Data Processing Addendum.
Questions about this page: privacy@pmt1.com