Trust · Security Program 1.10
Subprocessors
Only the companies on this list may process client data for us. Adding one takes a written comparison against an alternative, a data processing agreement, and 30 days' notice to our clients before it touches their data.
Client-data subprocessors
| Subprocessor | Purpose | Data location | Terms | Status |
|---|---|---|---|---|
| Microsoft Corporation (Microsoft 365) | Email, file storage (client workspaces), identity | United States | Microsoft Products and Services Data Protection Addendum | Active |
| Anthropic, PBC (Claude API) | AI processing of client data (US-only inference; standard retention: auto-deleted within 30 days, up to 2 years if flagged for a usage-policy violation, never used for training). Clients who choose zero data retention are processed on Amazon Bedrock instead, at no extra charge | United States (inference_geo us) | Anthropic Commercial Terms and Data Processing Addendum, accepted when the account was created | In setupnot yet processing client data |
| Amazon Web Services, Inc. (Amazon Bedrock) | AI processing only for clients who choose the zero-retention option (Anthropic does not offer zero data retention to PTAI). Bedrock data_retention_mode 'none' (nothing written to durable storage, nothing shared with the model provider), locked by an AWS policy; Fable models unavailable in this mode | United States (us-east/us-west regions only) | AWS Customer Agreement and AWS Data Processing Addendum | In setupnot yet processing client data; clients get 30 days’ notice before it is used |
Last updated October 14, 2026. A subprocessor marked in setup has no client data and receives none until its account, data processing terms and settings (US-only processing; retention turned off for zero-retention clients) are in place. Our own compliance check flags us if we ever hold client data while any entry on this list is not ready.
Changes to this list
- Before a new subprocessor touches client data, we compare it with at least one alternative on security, the path to get data back out, and reliability.
- We sign or accept its data processing terms and keep a copy on file.
- We give every client 30 days' written notice before it processes their data.
- This page is updated at the same time. We share the current list on request.
Services that run this website
These providers help deliver this public website. They never receive client data, because client data never passes through the website.
| Provider | What it does |
|---|---|
| Cloudflare | Hosts and delivers this website; processes standard request data (such as IP address and browser type) to serve pages and block attacks |
| Microsoft 365 (PTAI’s own account) | Delivers what you type into a form to Mike’s mailbox, where it is kept as an email |
Questions
Ask our Security Officer at security@precisiontolerance.ai. See how we handle your data from the day you send it to the day we certify it is deleted.