Subprocessors
Established8 parties
| Who | What they do | What they can reach | Region | Transfer mechanism |
|---|---|---|---|---|
| Porter | Application hosting. Runs the container that serves every request. | Document text in memory while a request is being served, and the platform's own operational logs. | Not established from this repository. Confirmed in writing on request. | Not established. Confirmed in writing with the region. |
| Amazon Web Services | The cloud underneath the product: the Kubernetes cluster the container runs in, the load balancer that terminates TLS, the S3 buckets the product writes - intake uploads, linked-source material, per-workspace output buckets - and Amazon Bedrock, where the engine's hosted inference runs. | The infrastructure the application runs on, so in principle everything it handles; the stored objects in those buckets; document text during inference. Whether the hosting cluster sits in an account we own or one the hosting platform operates is not established here. We will confirm it in writing. | US East for the application's stores and inference. A workspace's own output bucket is provisioned in the workspace's pinned region, which can be in the EU. | EU-US Data Privacy Framework: Amazon.com, Inc. and its covered affiliates, including AWS, are certified participants. |
| Supabase | Managed Postgres. The database, reached over its HTTP interface. | Everything the product stores: workspaces, members, configuration, the audit log, and uploaded document text until the retention clock deletes it. The engine's entity mapping is in the same database. | United States (US East). | Standard Contractual Clauses, incorporated in Supabase's data processing addendum. Supabase does not certify under the Data Privacy Framework. |
| Cloudflare | Authoritative DNS for the petrarch.co zone. | Nothing. This host is not proxied: Cloudflare sees a name lookup and no traffic. Turning proxying on would make Cloudflare a party to every request and every visitor's address. This row changes the same day. | Global anycast DNS. No customer data is in it anywhere. | Not applicable: it answers name lookups and receives no personal data. |
| GitHub | Source control, and the pipeline that builds and deploys the image. | No customer data. The source code and the deployment credential. | United States. | Not applicable: no customer data reaches it. |
| OAuth sign-in for Petrarch staff. | No customer data. Staff identity only: there is no Google account in the customer path. | United States. | Not applicable: staff identity only, no customer data. | |
| Infisical | Secrets manager. Holds the configuration values an operator puts into the hosting platform. | No customer data. Credentials for the services above. The application never calls it; the values are placed by hand at deploy time. Whether it also syncs into the running deployment is not established here. | Not established from this repository. | Not applicable: it holds service credentials, not personal data. |
| Amazon Simple Email Service | Sends the one message this product sends: an invitation to join a workspace. | The invited person's name and email, who invited them, the workspace name, any note the sender wrote, and the link. No document text, and no message to anybody not invited by name. The whole of the outbound mail: no notifications, digests or marketing, and nothing about a document, a run or a detection. Send the invitation link through your own channel instead if you would rather we did not mail your people. | US East (us-east-1), unless a deployment configures another region. | EU-US Data Privacy Framework, under the same Amazon certification as the AWS row. |
Not established3 open
Open questions, each explained on its row. One of them can receive document text - the model vendor named on the engine’s egress allow-list - which is exactly why it is listed before we can show the call. The mail row is about mail coming IN: a document attached to an email to us has left the product.
Anthropic
Model vendor. The de-identification engine's egress allow-list names its API as a second inference route beside Bedrock. Named on the engine deployment's egress allow-list (api.anthropic.com). Whether and when traffic flows is the engine's routing, not establishable from this repository; we confirm the current routing in writing. Region: United States. Transfer: Standard Contractual Clauses, per Anthropic's privacy policy. Not a Data Privacy Framework participant.
A container registry
Holds the built image between the build and the deployment. Managed by the hosting platform. We have not established which registry it is. Region: Not established. Transfer: Not applicable: no customer data.
Our own mail provider
Receives mail sent to our published addresses. Outside this application, so it is not established here. Ask before sending us a document by mail: only the product carries the retention clock. Region: Not established. Transfer: Not established.
Regions, and changes to this list
- Regions and transfer mechanisms are printed per party above; where a row says not established, we confirm it in writing rather than guess here.
- A workspace's own pinned region is shown inside the product, on its Workspace page, part by part.
- We give notice before adding a party, never inside a release note.
- If a row changes character - the DNS provider starting to proxy traffic - it changes the same day.
Something missing? Tell us at founders@petrarch.co. The rest of the security position is on the trust page.