The short version
These are the only outside companies that process customer data for us. Each is under contract to use it only to provide its service to us.
This summary is for convenience. The full text below is what applies.
1. Current subprocessors
| Company | What it does for us | Data involved | Location |
|---|---|---|---|
| Amazon Web Services, Inc. | Application hosting, database, file storage and backups | All customer data, encrypted at rest | United States |
| Cloudflare, Inc. | Domain name service, content delivery, protection against attacks, and the secure connection between the internet and our servers. Helping two devices find each other when a live session starts (the video and sound then go between the devices) | Web traffic passing to and from the service, IP addresses | Global network; traffic is handled at the location nearest the user |
| ActiveCampaign, LLC (Postmark) | Sending service emails: verification, password reset, invitations, notices, daily-log digests. Receiving email that people send or copy to a project’s own address, so it can be filed on that project | Recipient name and email address, and the content of the email; for mail sent to a project’s address, the sender, recipients, text and attachments of that message | United States |
| Stripe, Inc. | Subscription billing and payment processing | Billing contact, plan, and payment details you enter on Stripe’s pages. Stripe also acts as an independent controller of payment data. | United States |
| Anthropic, PBC | The Precon document-processing model (Claude), on PMT1’s own Precon key. Ask AI’s model (Claude Opus 5.5), on PMT1’s own separate Ask AI key with Anthropic’s standard global processing, only for workspaces whose owner has opted in to the Ask AI usage preview or accepted metered usage | For Precon: only the bid documents a Precon user selects (their full content, for the quote’s count and for an approved reading), the questions asked and the model’s answers. For Ask AI in an opted-in workspace: messages and the conversation, attached files and photos, the records it looks up, the text and page images of drawings, specifications and documents it reads, and the File Server names and details it looks up. Processed under terms that prohibit training on it; kept for a limited period under Anthropic’s standard commercial retention, longer where flagged under its usage policies or required by law. No zero-data-retention arrangement. | Ask AI: Anthropic’s standard global processing, which may run in the United States or other countries. Precon: the default processing location set for PMT1’s Precon account at Anthropic. Storage follows Anthropic’s data-residency settings for PMT1’s accounts. No single-country guarantee |
| OpenAI, L.L.C. | AI models behind the assistant (except in workspaces that opted in to Ask AI on Anthropic), voice transcription, and natural voices when a user chooses one (otherwise spoken replies are read by the user’s own device) | Only what is sent to the assistant: your messages, attached files and photos, voice audio, the records it looks up to answer, the text and page images of drawings, specifications and documents it reads for you, and the File Server names and details it looks up; for a natural voice, the reply text it reads. Not used for training. We ask OpenAI not to store response records; it may keep content up to 30 days for abuse monitoring, and some features keep data on their own schedules. No zero-data-retention arrangement. | United States |
| U.S. National Weather Service (NOAA) and the U.S. Census Bureau geocoder | Weather for the daily log. These are public services of the United States government, not vendors under contract to us; we list them because a little project data reaches them | The project’s street address (to find it on the map, once per project) and map coordinates rounded to about 100 m with the date. No names, no account details, nothing about your people. Not used if you type the weather in | United States |
OpenAI processes data only for companies that use the assistant. Anthropic processes Ask AI data only for companies whose owner opted in. Administrators can switch the assistant off in Settings.
2. Announced additions (not yet active)
Announced October 19, 2026, for activation only after the applicable advance notice and required review. It is not processing any customer data yet.
| Company | What it does for us | Data involved | Location |
|---|---|---|---|
| Autodesk, Inc. (Autodesk Platform Services) | Optional viewing of Revit and DWG files, only for companies whose owner or administrator switches it on | Only the original Revit (.rvt) or AutoCAD (.dwg) file a member adds to the design library while the feature is on (one file, up to 64 MiB). Autodesk keeps the uploaded copy up to 24 hours and the viewable version it prepares until PMT1 asks for its deletion (model or file removed, or the feature switched off); deletion is queued, not instant. A browser viewing pass can keep working up to one hour after access ends | United States |
3. Changes to this list
We update this page at least 30 days before a new subprocessor begins processing customer data. To be notified by email, write to privacy@pmt1.com with the subject “Subprocessor updates”. Customers may object to a new subprocessor as described in our Data Processing Addendum.
Questions about this page: privacy@pmt1.com