'%20stroke='url(%23em)'/%3e%3cellipse%20cx='30'%20cy='34'%20rx='26'%20ry='20'%20fill='url(%23gm)'/%3e%3cpath%20d='M12.5%2013.00L52.5%2021.74L52.5%2024.33L12.5%2017.60Z'%20fill='url(%23lm)'/%3e%3crect%20x='14.20'%20y='19.29'%20width='6.60'%20height='28.93'%20rx='1.45'%20fill='url(%23cm0)'/%3e%3crect%20x='27.00'%20y='21.24'%20width='5.60'%20height='24.81'%20rx='1.23'%20fill='url(%23cm1)'/%3e%3crect%20x='37.60'%20y='22.85'%20width='4.70'%20height='21.42'%20rx='1.03'%20fill='url(%23cm2)'/%3e%3crect%20x='46.60'%20y='24.22'%20width='4.00'%20height='18.53'%20rx='0.88'%20fill='url(%23cm3)'/%3e%3cpath%20d='M12.5%2050.00L52.5%2042.57L52.5%2044.26L12.5%2053.00Z'%20fill='%237fa3ff'%20opacity='.75'/%3e%3c/svg%3e)
PorticolSubprocessors
This page is the list of suppliers that process personal data on Porticol's behalf. It is the list referred to in the data processing agreement and referred to from the privacy policy.
It takes effect on 21 Oct 2026 and is published at https://porticol.app/legal/subprocessors.
1. Suppliers
| Category | Supplier | What it processes | Where |
|---|---|---|---|
| Cloud infrastructure and hosting | Amazon Web Services (compute, managed PostgreSQL with point-in-time recovery, object storage, secrets and key management, container hosting, monitoring) | The hosted service: the database holding accounts, workspaces, synchronised documents, audit entries, runs and billing records; backups; opt-in crash and usage reports, which our own intake receives; infrastructure logs, which hold IP addresses | The us-east-1 region, in Northern Virginia, United States, with backups replicated to the us-west-2 region, in Oregon, United States |
| Transactional email | Amazon Web Services (Amazon SES) | Email addresses and the content of service messages: sign-in, verification, password reset, invitations, billing and security notices, monitor alerts sent by email, and support requests sent from the app | The us-east-1 region |
| Website, documentation and update downloads | Amazon Web Services (Amazon S3 and CloudFront) | Requests for this website and for desktop update manifests and downloads, including IP addresses in access logs; no account is needed for either | Stored in the us-east-1 region, and served from CloudFront's edge locations worldwide |
| Licence service | Amazon Web Services | The installation, licence, seat count and version a Team Server sends to check its licence | The us-east-1 region |
| Status page | Amazon Web Services (AWS Lambda, Amazon S3 and CloudFront) | The health-check results and incident entries the status page publishes; it keeps no list of subscribers | Stored in the us-east-1 region, and served from CloudFront's edge locations worldwide |
| Payment processing | Stripe | The customer's email address, organisation and plan, the seats bought, and the checkout and billing portal pages; card details, which never reach Porticol | United States |
| Support mailbox | {{PLACEHOLDER:SUPPORT_MAILBOX_PROVIDER}} | Email to support@porticol.app: the support conversation and, only where you tick the box to attach them, the application version, platform and recent error messages. Never request content | Where that provider keeps the mailbox, named with it |
There is no analytics, measurement or advertising provider, no separate status page provider and no support partner.
2. Suppliers your organisation chooses
These are not ours. Your organisation decides to use them, configures them, and contracts with them. We connect to them only to provide the service.
- A SAML or OIDC identity provider, which vouches for people at your verified domains.
- SIEM destinations, such as syslog receivers, webhooks and S3-compatible buckets, which receive your organisation's audit entries.
- External secret managers, such as HashiCorp Vault, AWS Secrets Manager, Azure Key Vault and Google Secret Manager, which hold values that are resolved on a desktop at send time and never stored by Porticol.
3. Changes
We give 30 days' written notice before adding or replacing a supplier, by publishing the change on this page and, for customers on a paid cloud plan, writing to the address on the account. The notice names the supplier, the category, what it processes and where.
Objections, and what happens if we cannot resolve one, are in section 6 of the data processing agreement.
4. Questions
Write to privacy@porticol.app. Postal address: {{PLACEHOLDER:LEGAL_ENTITY_ADDRESS}}.