To support the delivery of our services, Portant.co may engage third-party service providers (‘sub-processors’) to process personal data on our behalf. We carefully vet each provider and ensure they are contractually bound to protect personal data in accordance with applicable privacy laws.
1. List of sub-processors
| Sub-processor | Nature and Purpose of Processing | Categories of personal data | Location of Processing | Security Measures |
|---|---|---|---|---|
| Anthropic PBC | AI model inference for content generation | Prompt content, source data | US | Anthropic DPA |
| Copper CRM, Inc. | Customer relationship management | Contact data, sales activity | US | Copper GDPR Compliance |
| Google LLC (Google Cloud) | Cloud infrastructure services | Application data, storage, compute | Global | Google Cloud DPA |
| Google LLC (Google Workspace) | Email, calendar, document storage, chat | Emails, documents, user metadata | Global | Google Workspace DPA |
| HubSpot, Inc. | Marketing, sales, CRM | Contact data, marketing analytics | US | HubSpot DPA |
| Intercom R&D Unlimited Company | Customer messaging platform | Messages, user behavior data | Global | Intercom DPA |
| Microsoft Corporation | Productivity and cloud services | Emails, documents, user data | Global | Microsoft DPA |
| OpenAI, L.P. | User selected AI language model services | Text inputs | US | Open AI DPA |
| AC PM LLC | Transactional email delivery | Contact data, Email content, metadata | US | Postmark DPA |
| Stripe, Inc. | Payment processing services | Payment data, customer information | Global | Stripe DPA |
| Zapier, Inc. | Workflow automation | Workflow data, user credentials | US | Zapier DPA |
2. Updates and Notifications
We are committed to transparency regarding the third-party service providers we engage.
Our list of sub-processors may change as our business evolves. When we add or replace a sub-processor who may process personal data, we will update this page to reflect those changes.
Where required by applicable data protection laws (such as the GDPR), we will provide our customers with prior notice of any intended changes to our sub-processors. This notification will be sent via email to the account owner or primary contact on record at least 30 days before the new sub-processor begins processing personal data on our behalf, except where a shorter notice period is required for urgent operational reasons.
During this notice period, customers may object to the engagement of a new sub-processor by contacting us at dpo@portant.co and providing a valid, reasonable objection related to data protection risks. We will work in good faith to resolve any objections and, if necessary, take reasonable steps to ensure that personal data is not processed by the new sub-processor until the issue is resolved.
If no objection is received within the notice period, the change will be deemed accepted.
We encourage all customers to check this page periodically for the latest information on our sub-processors.