Subprocessors.
The third-party services that help us deliver Partython AI. We keep this list public so your compliance team can see exactly who may process data, and why, before you sign anything.
Last updated May 31, 2026
To run Partython AI we rely on a small, deliberately short set of trusted vendors — “subprocessors” in data-protection terms. Each one handles a specific, limited part of the service. This page is the current, canonical list; it is referenced by our Data Processing Agreement (DPA) and Privacy Policy.
Infrastructure & hosting
Amazon Web Services (AWS)
India (ap-south-1, Mumbai)Cloud hosting — compute, the PostgreSQL database, and object storage. Transactional email delivery via Amazon SES is being wired up and is not yet live.
Data processed: All platform data (account details, conversation content, learned facts, billing metadata).
Let's Encrypt
United States / EUIssues and renews the TLS certificates that secure traffic to our domains.
Data processed: Domain names only — no personal data.
Payments & billing
Stripe
United States, IrelandSubscription billing and card payments for international customers.
Data processed: Name, email, billing address and a payment token. We never store full card numbers.
Razorpay
IndiaPayments for customers in India, including UPI and domestic cards.
Data processed: Name, email and payment details needed to complete the transaction.
AI / LLM providers
Anthropic
United StatesLarge language model inference (Claude) — generates AI agent responses.
Data processed: Conversation prompts (system instructions, retrieved knowledge, the end-user message).
OpenAI
United StatesLarge language model inference (GPT), including image understanding.
Data processed: Conversation prompts and, where image understanding is used, image content.
Groq
United StatesFast, lightweight language model inference for simpler queries.
Data processed: Conversation prompts (text only).
DeepSeek
People's Republic of ChinaLarge language model inference (DeepSeek-V3 and DeepSeek-R1) used as the primary complex-tier provider for cost-efficient frontier-quality responses.
Data processed: Conversation prompts (system instructions, retrieved knowledge, the end-user message) — text only.
Moonshot AI (Kimi)
People's Republic of ChinaSecondary fallback for large language model inference when DeepSeek or another upstream provider is unavailable.
Data processed: Conversation prompts — text only.
Anthropic, OpenAI and Groq do not train their models on data sent through their APIs. DeepSeek's and Moonshot's published API terms reserve broader rights to use API inputs for model improvement; we are tracking opt-out availability with both providers and will list it on this page once confirmed. We do not fine-tune any model on customer conversations — prompts are used for inference only.
Messaging channels
Meta Platforms
United StatesDelivers messages to and from WhatsApp, Instagram and Messenger.
Data processed: End-user messages and the identifiers (e.g. phone number, Instagram user ID) needed to route a conversation.
Where data is processed
Primary processing region is AWS ap-south-1 (Mumbai, India), which keeps platform data in India for DPDP purposes. AI inference and payment processing involve transfers to providers in the US, EU, and People's Republic of China, covered by Standard Contractual Clauses and equivalent transfer mechanisms. A multi-region option (EU and US data residency) is on the roadmap.
Changes to this list
We may add or replace a subprocessor as the product evolves. Customers with a signed DPA are notified of material changes with reasonable advance notice (target: 30 days) and may raise objections as set out in the DPA.
Questions
Questions about this list, or want to be notified of changes? Get in touch and choose the “DPA / Data Processing” topic.