Sub-processors
Last reviewed: 20 October 2026
PanLuma engages the third parties below to operate the platform. Each is bound by a Data Processing Agreement (DPA) and uses appropriate technical and organisational measures to protect customer data.
This list is reviewed annually and updated whenever a sub-processor is added, replaced, or removed. This page is the published form of our version-controlled sub-processor list, which records the full data categories and DPA reference for each entry.
We update this page before a new sub-processor begins processing customer data, and notify each workspace’s admins of the addition in the app or by email. If you have a reasonable data-protection objection to a new sub-processor, email privacy@panluma.ai within 15 days of that notice; we will work with you to address it, and if we cannot, you may stop using the affected feature or close your account.
Always-on sub-processors (required for platform operation)
| Sub-processor | Purpose | Region |
|---|---|---|
| Amazon Web Services | Hosting infrastructure: application, database, cache, object storage, CDN/WAF, secrets, logs, DNS. | us-east-1 (N. Virginia) |
| Anthropic (Claude) | LLM provider for in-app AI assistants, AI agents, AI Chat, AI evaluation, and coding tasks. Does not train on API customer data. | United States, EU SCCs |
| Twilio / SendGrid | Transactional email (notifications, password resets, customer-portal invites, support replies). | United States, EU SCCs |
| MaxMind (GeoLite2) | IP-to-geolocation lookup via a local database. No live API calls. | Local processing only |
| Stripe | Payment processing for your own PanLuma subscription and usage billing. Card details are entered directly into Stripe’s hosted fields. | United States, EU SCCs |
User-initiated integrations
These sub-processors receive customer data only when a customer explicitly connects the integration in their workspace, by granting OAuth access or entering an API key. Disconnecting revokes the grant.
| Sub-processor | Purpose | Region |
|---|---|---|
| Gmail, Drive, Sheets, Docs, Calendar, Maps, Google SSO. Also Google Ads lead forms and offline conversion import for marketing. | United States, EU SCCs | |
| Microsoft | Microsoft SSO, Outlook Mail, Outlook Calendar, OneDrive, Excel. | Multi-region, EU SCCs |
| Apple | Sign in with Apple (SSO), including the optional private email relay. | United States, EU SCCs |
| Notion | Notion workspace access for the connecting user. | United States, EU SCCs |
| Meta | Meta Lead Ads and WhatsApp Business inbound messages become leads and contacts; Meta Conversions API sends server-side conversion events. | United States / Ireland, EU SCCs |
| Stripe | Card payment collection from your customers via Stripe Connect, settling to your own Stripe account. Separate from the always-on entry above, which is your own PanLuma bill. | United States, EU SCCs |
| Plaid | Bank-feed aggregation for the accounting module (balances, transactions, account metadata). | United States, EU SCCs |
| Mercury | Direct bank-feed sync for Mercury accounts in the accounting module. | United States |
| Shopify | Two-way commerce sync: product catalogue, stock levels, orders imported as sales orders, shoppers imported as contacts. | Canada / United States, EU SCCs |
| Ocean carriers (DCSA Track & Trace) | Direct-from-carrier container milestone tracking for the shipments module. Each carrier is bound by your own contract with that carrier. | Carrier-dependent (global) |
| OpenAI | Alternative LLM provider — only when the tenant supplies their own API key. | United States, EU SCCs |
| Google Gemini API | Alternative LLM provider — only when the tenant supplies their own API key. | United States, EU SCCs |
| Morning (Green Invoice) | Statutory Israeli tax invoicing — only when the tenant supplies their own API key. Receives the invoice or receipt pushed for issuance. | Israel |
| Front | Reading the shared inboxes a workspace runs in its own Front account as shared mailboxes, and posting replies back into the Front conversation — only when the workspace connects its own Front account. | United States (EU per your Front account) |
Supporting sub-processors
| Sub-processor | Purpose | Region |
|---|---|---|
| PostHog | Product analytics for the application (opt-out available per tenant). | EU (Frankfurt) |
| Plausible | Privacy-first, cookie-free analytics for the marketing site only. | EU (Germany) |
| Serper.dev | Web search service used by AI agents. | United States, EU SCCs |
| ShipsGo | Default ocean-container tracking provider. Receives container and booking references. | Italy / EU |
| Terminal49 | Alternative ocean-container tracking provider. Receives container and booking references. | United States |
| OpenRouter | AI model pricing reference data. No customer data sent. | United States |
| Simli | Avatar video generation for the avatar feature. | United States, EU SCCs |
| Deepgram | Speech-to-text for avatar / voice features. | United States, EU SCCs |
| Cartesia | Text-to-speech for avatar / voice features. | United States, EU SCCs |
| E2B | Code-execution sandboxes for the coding module and certain agent tools. | United States, EU SCCs |
| Yahoo Finance | Public financial data. No customer data sent. | United States |
| GitHub | Source-code hosting for PanLuma’s own engineering. No customer data flows at runtime. | United States, EU SCCs |
Pending sub-processors (not yet active)
The integrations below are not yet in service: either the connector is still marked as coming soon in our catalogue, or it has shipped but is not provisioned in our production environment. They do not currently process any customer data, and each will be promoted to the lists above — with notice as described at the top of this page — when it goes live: Slack, GitHub (as a user-facing integration, distinct from source-code hosting above), Jira, Salesforce, HubSpot, QuickBooks, Zendesk, Calendly (importing Calendly Notetaker meeting recaps onto contact and deal timelines), Citizens Bank (direct bank-feed sync of commercial checking and savings accounts for the accounting module), Sage Intacct (posting a tenant’s invoices, bills, payments and journals into the tenant’s own Sage Intacct general ledger), E2open / INTTRA (ocean-carrier booking, shipping-instruction and VGM messaging), FullEnrich (business-email finding for prospecting, and LinkedIn profile lookup for recruiting candidate import), TypeSafe AI (a decision model that classifies inbound operations email for the shipments module), CrimsonLogic / GeTS (US customs e-filing for the shipments module: AES / EEI export declarations, ISF and AMS — your company stays the filer of record; the connector has shipped but stays interlocked until the vendor contract is confirmed), and ZeroBounce (email-deliverability verification for prospecting).
Content processing by AI and other intelligent-feature providers
These are the providers that receive your content — messages, emails, files, voice — to power intelligent features, as described in Section 6B of our Privacy Policy. You consent to this processing in the app. None of them may use your content to train, fine-tune or improve their models.
| Provider | Country | Purpose | Data sent | Retention |
|---|---|---|---|---|
| Anthropic | US | LLM inference for AI Chat, AI Agents, and per-module AI assistants | Your messages, attached entity context (e.g. the record you’re viewing), and tool-call inputs/outputs | Real-time inference only; not retained beyond the request |
| Deepgram | US | Speech-to-text when you use voice input | Audio captured during dictation | Real-time transcription only; not retained |
| Cartesia | US | Text-to-speech when AI features speak responses to you | Text strings to be spoken | Real-time synthesis only; not retained |
| Simli | US | Optional AI video avatar (only if you enable it) | Audio and avatar identifiers | Real-time only; not retained |
| Serper | US | Web search, when an AI agent runs a task that needs internet results | The search query the agent issues, which may contain terms drawn from your content | Real-time query only; not retained by us |
| E2B | US | Sandboxed code execution for the coding module and certain agent tools | Code to be executed and its inputs | Ephemeral sandboxes, destroyed after the run |
| OpenAI | US | Alternative LLM inference — only if your workspace supplies its own OpenAI API key | Same as Anthropic above: your messages, attached entity context, and tool-call inputs/outputs | Real-time inference only; not retained beyond the request |
| Google Gemini | US | Alternative LLM inference — only if your workspace supplies its own Google Gemini API key | Same as Anthropic above: your messages, attached entity context, and tool-call inputs/outputs | Real-time inference only; not retained beyond the request |
OpenAI and Google Gemini are inactive unless your workspace administrator enters that provider’s API key; until then no content reaches them.
Questions
For sub-processor questions or to request our customer DPA, email privacy@panluma.ai.