Trust & Compliance
Sub-processors
Patternwise uses the third parties below to operate the service. Each processes personal data only on our behalf, under a Data Processing Agreement, and only for the purpose listed. This list is the same one referenced by our Privacy Policy.
Summary of Changes
- 2026-06-22Simplified the disclosure: purposes are now stated as general function categories (e.g. Cloud Infrastructure, AI Processing, Billing & Payments), and the data we share is described once by recipient category rather than per vendor.
- 2026-06-21Added Deepgram (voice-to-text transcription). Published ratified per-provider transfer mechanisms (DPF / SCCs) in place of the prior placeholder.
- 2026-06-14Added Upstash and Cloudflare as infrastructure sub-processors.
- 2026-04-24Initial publication of the sub-processor list.
What data we share, by category
- AI & machine learning
- Entry content and the context needed to analyze it — including the names of people you mention. Your own name, email, and billing identifiers are never sent. Voice audio is sent for transcription only and is not retained.
- Infrastructure
- Account data, your encrypted content, and technical metadata such as IP address and timestamps. Where your entries power search and memory, they are stored as numerical representations — not their readable text.
- Payments
- Billing metadata only — never your journal content.
- Your email address and display name.
| Provider | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| AI & machine learning | |||
| Anthropic Anthropic, PBC | AI Processing | United States | SCCs (Module 2) + UK Addendum |
| Google (Vertex AI / Gemini) Google LLC | AI Processing | United States | EU-US DPF (self-certified, all 3 scopes) + SCCs (Module 2 C2P) + UK IDTA |
| OpenAI OpenAI, L.L.C. | AI Processing | United States | SCCs (Module 2) + UK Addendum; EEA via OpenAI Ireland Ltd. |
| Deepgram Deepgram, Inc. | AI Processing | United States | SCCs (Module 2) + UK IDTA + Swiss addendum |
| Infrastructure | |||
| Pinecone Pinecone Systems, Inc. | Cloud Infrastructure | United States | SCCs (Module 2) + UK IDTA + Swiss addendum |
| Upstash Upstash, Inc. | Cloud Infrastructure | United States | EU-US DPF (self-certified) + SCCs (Module 2 fallback) + UK IDTA |
| Google (Firebase + Cloud) Google LLC | Cloud Infrastructure | United States | EU-US DPF (self-certified, all 3 scopes) + SCCs (Module 2 C2P) + UK IDTA |
| Cloudflare Cloudflare, Inc. | Security & Network | United States | EU-US DPF (self-certified, all 3 scopes) + SCCs (Module 2 C2P) + UK IDTA |
| Payments | |||
| Stripe Stripe, Inc. | Billing & Payments | United States | EU-US DPF (self-certified, all 3 scopes) + SCCs (Module 2 C2P) + UK IDTA |
| Apple App Store Apple Inc. | Billing & Payments | United States | Apple App Store terms (no journal content) |
| Google Play Google LLC | Billing & Payments | United States | Covered by Google EU-US DPF |
| Resend Plus Five Five, Inc. | Communications | United States | EU/UK: EU-US DPF (self-certified) + SCCs (Module 2); CH: SCCs (Module 2) + Swiss FADP mods |
Notice of new sub-processors
When we add a new sub-processor, we update this page and reflect the change in the Summary of Changes above. If you object to a new sub-processor, email privacy@patternwise.app within 30 days of the change. We will work with you in good faith to address your concern.