Legal
Sub-processors
Everyone who touches customer data on our behalf, what they do with it, and where they do it.
Version 2026-09 · Last updated September 4, 2026
1.Current sub-processors
These companies process customer data on our behalf to run the Service. Each is bound by a written agreement with data-protection terms at least as protective as our Data Processing Addendum.
| Provider | Purpose | Data involved | Location |
|---|---|---|---|
| Vercel, Inc. | Application hosting, serverless compute, and edge network | All Service traffic and content in transit | United States |
| Supabase, Inc. | Postgres database, file storage, and vector search | Workspace content, account records, billing state | United States |
| Clerk, Inc. | Authentication and user identity | Name, email, profile picture, sign-in metadata | United States |
| Stripe, Inc. | Payments, subscriptions, invoicing, and tax calculation | Billing name and address, payment method, invoice history | United States |
| OpenAI, L.L.C. | AI extraction, embedding, and drafting, under Zero Data Retention terms | Uploaded document text and workspace content sent per request; not retained | United States |
| Inngest, Inc. | Background workflow orchestration (ingestion, billing crons) | Job metadata and event payloads referencing workspace records | United States |
| Google LLC | Website analytics (Google Analytics 4), marketing site only, after consent | Pseudonymous page views, device and browser type, truncated IP; no workspace content | United States |
2.Professional-services consultants
When you purchase a professional-services engagement, the consultant delivering it, who may be an independent contractor engaged by pmmRush, receives the workspace content needed for that engagement. Consultants are bound by confidentiality and data-protection obligations under their agreement with pmmRush and act only on our instructions.
3.Changes to this list
We will update this page at least 30 days before a new sub-processor begins processing customer data, except where a change is needed urgently to keep the Service secure or available, in which case we will notify you as soon as practicable. Workspace administrators can subscribe to change notices by emailing privacy@pmmrush.com. If you object to a new sub-processor on reasonable data-protection grounds, the DPA sets out what happens next.